https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 12:39:14 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-107215 <p>Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review.</p> <p>Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-107215 https://vulnerability.circl.lu/vuln/ghsa-x2q3-8cjh-766f <p><strong>Affected:</strong> Go: github.com/xuri/excelize/v2</p> <p>### Summary</p> <p>`extractPart` allocates directly from the mscfb directory-entry size with no clamping (`crypt.go:198`, same missing bound at `crypt.go:204`):</p> <p>```go buf := make([]byte, entry.Size) ```</p> <p>`entry.Size` is the raw `streamSize` field from the attacker-controlled CFB directory entry (mscfb v1.0.8 `fixFile`, `file.go:109-120`: full uint64 → int64 for major version 4, low uint32 for v3). mscfb only detects short sector chains later, inside `File.Read` (`file.go:485-489` &#34;emergency brake&#34;) — i.e. **after** the allocation. The zip path already enforces `UnzipSizeLimit`, and the KDF path bounds work with `maxSpinCount`; this path consults no limit at all.</p> <p>### Details</p> <p>Two consequences, both execution-confirmed against pristine master (`ecd99d761fe0`, 2026-09-08):</p> <p>1. **Hard crash**: a version-4 CFB declaring `streamSize = 0xFFFFFFFFFFFFFFFF` yields `entry.Size == -1` → `panic: runtime error: makeslice: len out of range`, which escapes `Decrypt` (`openReaderAt` converts errors, not panics, `excelize.go:210-214`) and kills the process. 2. **Memory exhaustion**: any CFB (v3 suffices) declaring `streamSize` up to `0xFFFFFFFF` forces up to 4 GiB of zeroed allocation from a ~12 KB file — an amplification factor of ~350,000×, trivially repeated per request in memory-limited deployments.</p> <p>Call path: `OpenFile`/`OpenReader`/`OpenBytes` → `openReaderAt` (`excelize.go:208-215`, OLE magic sniff) → `Decrypt` (`crypt.go:145-150`) → `extractPart` (`crypt.go:198`).</p> <p>### PoC</p> <p>A standalone…</p> <p><strong>Affected:</strong> Go: github.com/xuri/excelize/v2</p> <p>### Summary</p> <p>`extractPart` allocates directly from the mscfb directory-entry size with no clamping (`crypt.go:198`, same missing bound at `crypt.go:204`):</p> <p>```go buf := make([]byte, entry.Size) ```</p> <p>`entry.Size` is the raw `streamSize` field from the attacker-controlled CFB directory entry (mscfb v1.0.8 `fixFile`, `file.go:109-120`: full uint64 → int64 for major version 4, low uint32 for v3). mscfb only detects short sector chains later, inside `File.Read` (`file.go:485-489` &#34;emergency brake&#34;) — i.e. **after** the allocation. The zip path already enforces `UnzipSizeLimit`, and the KDF path bounds work with `maxSpinCount`; this path consults no limit at all.</p> <p>### Details</p> <p>Two consequences, both execution-confirmed against pristine master (`ecd99d761fe0`, 2026-09-08):</p> <p>1. **Hard crash**: a version-4 CFB declaring `streamSize = 0xFFFFFFFFFFFFFFFF` yields `entry.Size == -1` → `panic: runtime error: makeslice: len out of range`, which escapes `Decrypt` (`openReaderAt` converts errors, not panics, `excelize.go:210-214`) and kills the process. 2. **Memory exhaustion**: any CFB (v3 suffices) declaring `streamSize` up to `0xFFFFFFFF` forces up to 4 GiB of zeroed allocation from a ~12 KB file — an amplification factor of ~350,000×, trivially repeated per request in memory-limited deployments.</p> <p>Call path: `OpenFile`/`OpenReader`/`OpenBytes` → `openReaderAt` (`excelize.go:208-215`, OLE magic sniff) → `Decrypt` (`crypt.go:145-150`) → `extractPart` (`crypt.go:198`).</p> <p>### PoC</p> <p>A standalone…</p> https://vulnerability.circl.lu/vuln/ghsa-x2q3-8cjh-766f