CVE-2026-41511: 
C# vulnerability analysis and mitigation

CVE-2026-41511 is an infinite loop denial-of-service vulnerability in OpenMcdf, a .NET/C# library for manipulating Compound File Binary (CFB) files. The flaw affects all OpenMcdf versions prior to 3.1.3 and was discovered by researcher "pawlos," disclosed on April 20, 2026, and published to the GitHub Advisory Database on April 22, 2026. A crafted CFB file with a cyclic LeftSiblingID/RightSiblingID chain in the directory entry red-black tree causes Storage.EnumerateEntries() and Storage.OpenStream() to loop indefinitely, with no recovery possible via try/catch. The vulnerability carries a CVSS v3.1 base score of 6.2 (Moderate) per the GitHub Advisory, or 5.5 (Medium) per NVD (GitHub Advisory, OpenMcdf Advisory).

The root cause is CWE-835 (Loop with Unreachable Exit Condition). CFB directory entries form a red-black tree linked by LeftSiblingID and RightSiblingID fields; OpenMcdf's DirectoryTreeEnumerator and DirectoryTree.TryGetDirectoryEntry traverse this tree without tracking visited node IDs, making cycle detection impossible. A crafted cycle — for example, entry A's RightSiblingID pointing to entry B and entry B's LeftSiblingID pointing back to entry A — causes two distinct code paths to hang: DirectoryTreeEnumerator.MoveNext() never returns false (heap grows unboundedly), and DirectoryTree.TryGetDirectoryEntry loops indefinitely inside DirectoryEntries.TryGetSibling. A crafted file only needs a valid CFB magic header (D0 CF 11 E0 A1 B1 1A E1) to pass initial format validation and reach the vulnerable traversal code. The fix implements Brent's cycle detection algorithm in DirectoryTreeEnumerator.cs, throwing a FileFormatException when a loop is detected (OpenMcdf Advisory, Fix Commit).

Successful exploitation causes a denial of service against any application that opens untrusted CFB files using OpenMcdf. The affected calling thread is consumed indefinitely with no possibility of recovery via exception handling — the process must be killed to restore availability. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue affecting the thread processing the malicious file (GitHub Advisory, OpenMcdf Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub security advisory, consisting of a runnable C# code snippet that loads a crafted CFB file and triggers the infinite loop (OpenMcdf Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.012–0.015%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft a malicious CFB file: Create a Compound File Binary document with a valid CFB magic header (D0 CF 11 E0 A1 B1 1A E1) and a cyclic directory entry structure — for example, set entry A's RightSiblingID to point to entry B, and entry B's LeftSiblingID to point back to entry A.
2. Deliver the file to the target application: Supply the crafted .cfb file (or a file format that internally uses CFB, such as legacy Office documents) to an application that uses OpenMcdf versions prior to 3.1.3 to parse untrusted files.
3. Trigger vulnerable code path: The application opens the file using RootStorage.Open() and calls Storage.EnumerateEntries() or Storage.OpenStream(), initiating traversal of the directory red-black tree.
4. Infinite loop achieved: DirectoryTreeEnumerator.MoveNext() never returns false due to the cycle, causing the calling thread to loop indefinitely. Heap memory grows unboundedly in the EnumerateEntries() path. No exception is thrown, so try/catch blocks cannot interrupt execution.
5. Denial of service: The affected thread is permanently consumed, rendering the application unresponsive. The only recovery is killing the process (OpenMcdf Advisory).

• Process Behavior: Application process consuming 100% CPU on a single thread indefinitely after opening a CFB file; process becomes unresponsive and does not terminate normally.
• Memory: Unbounded heap growth in the application process when Storage.EnumerateEntries() is triggered, observable via memory monitoring tools.
• File System: Presence of unexpected or externally supplied .cfb, .doc, .xls, .ppt, or other CFB-format files in directories processed by the application.
• Logs: Application logs showing a CFB file open operation with no subsequent completion or error log entry; absence of expected post-processing log entries after file ingestion (OpenMcdf Advisory).

Upgrade OpenMcdf to version 3.1.3 or later, which implements Brent's cycle detection algorithm in DirectoryTreeEnumerator.cs to detect and throw a FileFormatException on cyclic directory trees (OpenMcdf Release, Fix Commit). Until patching is possible, implement input validation to reject CFB files from untrusted sources before passing them to OpenMcdf. As an additional safeguard, run OpenMcdf file-processing operations in isolated threads with a timeout mechanism so that hung operations can be detected and the thread terminated without killing the entire process.