fkie_cve-2026-41511

OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. Prior to version 3.1.3, OpenMcdf does not detect cycles in the directory entry red-black tree of a Compound File Binary (CFB) document. A crafted CFB file with a cycle in the LeftSiblingID / RightSiblingID chain causes Storage.EnumerateEntries() and Storage.OpenStream() to loop indefinitely, consuming the calling thread with no possibility of recovery via try/catch. This issue has been patched in version 3.1.3.

GHSA-jxpf-xq2m-q525 — OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle

Affected: NuGet: OpenMcdf

### Summary OpenMcdf does not detect cycles in the directory entry red-black tree of a Compound File Binary (CFB) document. A crafted CFB file with a cycle in the `LeftSiblingID` / `RightSiblingID` chain causes `Storage.EnumerateEntries()` and `Storage.OpenStream()` to loop indefinitely, consuming the calling thread with no possibility of recovery via `try/catch`.

### Details CFB directory entries form a red-black tree linked by `LeftSiblingID` and `RightSiblingID` fields. OpenMcdf's `DirectoryTreeEnumerator` and `DirectoryTree.TryGetDirectoryEntry` traverse this tree without tracking visited node IDs, so a crafted cycle (e.g. entry A's `RightSiblingID` points to entry B, and entry B's `LeftSiblingID` points back to entry A) causes traversal to loop indefinitely.

Two distinct code paths are affected:

- **`Storage.EnumerateEntries()`** - `DirectoryTreeEnumerator.MoveNext()` never returns `false`; the same entry is yielded on every iteration and the caller's `foreach` never exits. Heap grows unboundedly as entries accumulate. - **`Storage.OpenStream()`** - `DirectoryTree.TryGetDirectoryEntry` loops indefinitely inside `DirectoryEntries.TryGetSibling` during the name lookup.

### PoC A crafted CFB file with a sibling cycle (see attached) triggers the issue with the following code:

```csharp using OpenMcdf;

using var ms = new MemoryStream(File.ReadAllBytes("crafted.cfb")); using var root = RootStorage.Open(ms);

// Never returns - EnumerateEntries loops indefinitely foreach…

Most recent entries from all

fkie_cve-2026-41511

GHSA-jxpf-xq2m-q525 — OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle