CVE-2026-45785: 
C# vulnerability analysis and mitigation

CVE-2026-45785 is an infinite loop (denial of service) vulnerability in the OpenMcdf library's DirectoryTree.TryGetDirectoryEntry function, affecting all versions up to and including 3.1.3 of the OpenMcdf NuGet package. A crafted Compound File Binary (CFB) file with cyclic Left/Right sibling links in its directory entries can drive the BST name-lookup loop in DirectoryTree.cs (lines 35–46) into an infinite spin, permanently hanging the affected thread. The vulnerability was reported by researcher "pawlos," published as a security advisory on May 14, 2026, and added to the GitHub Advisory Database on May 19, 2026. It carries a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory, OpenMcdf Advisory).

The root cause is CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). The TryGetDirectoryEntry method in OpenMcdf/DirectoryTree.cs (lines 35–46) traverses directory entries in a while (child is not null) loop by repeatedly calling directories.TryGetSibling(child, siblingType, validateColor). A specially crafted CFB file can embed cyclic Left/Right sibling references among directory entries such that the per-step BST-order check in TryGetSibling (DirectoryEntries.cs:84-85) is satisfied at every iteration, preventing the loop from ever terminating. Critically, no cycle detection exists in TryGetDirectoryEntry, and because no exception is raised, try/catch blocks in calling code cannot protect against the hang. The vulnerable code path is reachable via the public APIs OpenStorage, TryOpenStorage, OpenStream, and TryOpenStream — including the common pattern of iterating EnumerateEntries() and calling OpenStream(entry.Name) per entry (note: EnumerateEntries() alone is protected by a prior Brent's-algorithm commit, but the lookup path is not) (GitHub Advisory, OpenMcdf Advisory).

Successful exploitation causes a permanent denial of service: the thread processing the malicious CFB file spins at 100% CPU and cannot recover without killing the entire process. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Any application that opens untrusted CFB files using OpenMcdf is affected, including downstream consumers such as .msg-file parsers that depend on OpenMcdf transitively, potentially causing cascading service disruption across dependent software (GitHub Advisory, OpenMcdf Advisory).

1. Craft or obtain a malicious CFB file: Create a CFB file with cyclic Left/Right sibling links in its directory entries, ensuring each link satisfies the per-step BST-order check in TryGetSibling so no exception is raised. Alternatively, use the published PoC files (repro_lookup.cfb or repro_enumerate.cfb) from the advisory.
2. Deliver the file to the target application: Submit the crafted CFB file to any application that uses OpenMcdf ≤ 3.1.3 to parse untrusted files — for example, a .msg-file parser, document processor, or file upload endpoint.
3. Trigger the vulnerable code path: The application calls one of the affected APIs (OpenStorage, TryOpenStorage, OpenStream, or TryOpenStream) on the malicious file, or iterates EnumerateEntries() and calls OpenStream(entry.Name) per stream entry.
4. Achieve denial of service: The TryGetDirectoryEntry loop enters an infinite spin at 100% CPU. The affected thread hangs indefinitely and cannot be recovered by try/catch. The process must be killed to restore service (GitHub Advisory, OpenMcdf Advisory).

• Process Behavior: A process hosting an OpenMcdf-based application consuming 100% CPU on a single thread indefinitely while processing a CFB/MSG file, with no progress or termination.
• File System: Presence of small, anomalous CFB files (e.g., ~5–8 KB) submitted to file-processing endpoints or found in upload directories; files with unusual or cyclic directory entry structures detectable via CFB format analysis tools.
• Logs: Application logs showing a call to OpenStorage, TryOpenStorage, OpenStream, or TryOpenStream that never returns or logs completion; absence of expected post-processing log entries after CFB file ingestion.
• Network: Repeated submission of the same small CFB file from an external source to a file-processing service, potentially indicating automated DoS attempts (GitHub Advisory).

Upgrade OpenMcdf to version 3.1.4, which patches the vulnerability by adding cycle detection to the TryGetDirectoryEntry lookup path. No configuration-based workaround is available since try/catch cannot intercept the infinite loop. As an interim measure, applications should avoid processing untrusted CFB files until the patch is applied, or implement process-level timeouts to kill hung threads (GitHub Advisory, OpenMcdf Advisory).