Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
36 vulnerabilities by qax-os
CVE-2026-107225 (GCVE-0-2026-107225)
Vulnerability from nvd – Published: 2026-10-07 18:55 – Updated: 2026-10-10 02:42
VLAI
EPSS
VEX
Title
Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 02:41 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2367 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/ae2113b… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107225",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T02:41:58.921948Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T02:42:21.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.8.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle\u0027s fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:55:55.603Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65"
},
{
"name": "https://github.com/qax-os/excelize/pull/2367",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2367"
},
{
"name": "https://github.com/qax-os/excelize/commit/ae2113b410e51f6a141c396a59eda8c42b91bc22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/ae2113b410e51f6a141c396a59eda8c42b91bc22"
}
],
"source": {
"advisory": "GHSA-5h23-36rv-pm65",
"discovery": "UNKNOWN"
},
"title": "Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107225",
"datePublished": "2026-10-07T18:55:55.603Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-10T02:42:21.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107224 (GCVE-0-2026-107224)
Vulnerability from nvd – Published: 2026-10-07 18:53 – Updated: 2026-10-07 19:30
VLAI
EPSS
VEX
Title
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:29 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2369 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/db93f8d… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107224",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:29:38.692124Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:30:13.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.1.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-681",
"description": "CWE-681: Incorrect Conversion between Numeric Types",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:53:27.282Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw"
},
{
"name": "https://github.com/qax-os/excelize/pull/2369",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2369"
},
{
"name": "https://github.com/qax-os/excelize/commit/db93f8d89de71589069a54d1b998af02e3c5f7cd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/db93f8d89de71589069a54d1b998af02e3c5f7cd"
}
],
"source": {
"advisory": "GHSA-fw94-4wwp-w8pw",
"discovery": "UNKNOWN"
},
"title": "Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107224",
"datePublished": "2026-10-07T18:53:27.282Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-07T19:30:13.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107223 (GCVE-0-2026-107223)
Vulnerability from nvd – Published: 2026-10-07 18:48 – Updated: 2026-10-07 22:05
VLAI
EPSS
VEX
Title
Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 22:03 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2370 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/a54c578… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107223",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T22:03:57.126591Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T22:05:27.449Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.1.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:48:54.172Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-fq3v-74gv-27gm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-fq3v-74gv-27gm"
},
{
"name": "https://github.com/qax-os/excelize/pull/2370",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2370"
},
{
"name": "https://github.com/qax-os/excelize/commit/a54c578af309fa81f448143ed2b7a91192cc58a7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/a54c578af309fa81f448143ed2b7a91192cc58a7"
}
],
"source": {
"advisory": "GHSA-fq3v-74gv-27gm",
"discovery": "UNKNOWN"
},
"title": "Excelize: Unbounded \u003ccol max\u003e attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107223",
"datePublished": "2026-10-07T18:48:54.172Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-07T22:05:27.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107222 (GCVE-0-2026-107222)
Vulnerability from nvd – Published: 2026-10-07 18:45 – Updated: 2026-10-08 16:09
VLAI
EPSS
VEX
Title
Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 16:09 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2375 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/be7a163… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107222",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T16:09:18.703933Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T16:09:37.888Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.7.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:45:20.249Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr"
},
{
"name": "https://github.com/qax-os/excelize/pull/2375",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2375"
},
{
"name": "https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd"
}
],
"source": {
"advisory": "GHSA-rxcj-4pj5-74gr",
"discovery": "UNKNOWN"
},
"title": "Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107222",
"datePublished": "2026-10-07T18:45:20.249Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-08T16:09:37.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107221 (GCVE-0-2026-107221)
Vulnerability from nvd – Published: 2026-10-07 18:41 – Updated: 2026-10-07 19:17
VLAI
EPSS
VEX
Title
Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and checkRow, where targetList is too short for an earlier out-of-order cell. When a crafted row places a higher-column cell before a lower-column final cell and a non-streaming worksheet API reads the sheet, the earlier cell's column index exceeds the slice length derived from the final cell, allowing an attacker to cause an unrecovered panic and terminate the process. No fixed version is available as of this review.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:17 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2376 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/46a5eb2… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107221",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:17:00.546092Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:17:06.445Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-8mcq-6wmr-jrjv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and checkRow, where targetList is too short for an earlier out-of-order cell. When a crafted row places a higher-column cell before a lower-column final cell and a non-streaming worksheet API reads the sheet, the earlier cell\u0027s column index exceeds the slice length derived from the final cell, allowing an attacker to cause an unrecovered panic and terminate the process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:41:46.047Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-8mcq-6wmr-jrjv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-8mcq-6wmr-jrjv"
},
{
"name": "https://github.com/qax-os/excelize/pull/2376",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2376"
},
{
"name": "https://github.com/qax-os/excelize/commit/46a5eb289448e40fbc7d3294589b03861fb822f0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/46a5eb289448e40fbc7d3294589b03861fb822f0"
}
],
"source": {
"advisory": "GHSA-8mcq-6wmr-jrjv",
"discovery": "UNKNOWN"
},
"title": "Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107221",
"datePublished": "2026-10-07T18:41:46.047Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-07T19:17:06.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107220 (GCVE-0-2026-107220)
Vulnerability from nvd – Published: 2026-10-07 18:37 – Updated: 2026-10-10 02:41
VLAI
EPSS
VEX
Title
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 02:39 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2379 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/99903a3… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107220",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T02:39:12.566271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T02:41:14.449Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.7.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:37:52.712Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff"
},
{
"name": "https://github.com/qax-os/excelize/pull/2379",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2379"
},
{
"name": "https://github.com/qax-os/excelize/commit/99903a3240e58a47ff28fb8e05a03bd9d496ec24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/99903a3240e58a47ff28fb8e05a03bd9d496ec24"
}
],
"source": {
"advisory": "GHSA-g27h-8qhm-6pff",
"discovery": "UNKNOWN"
},
"title": "Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107220",
"datePublished": "2026-10-07T18:37:52.712Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-10T02:41:14.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107219 (GCVE-0-2026-107219)
Vulnerability from nvd – Published: 2026-10-07 18:33 – Updated: 2026-10-07 19:45
VLAI
EPSS
VEX
Title
Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes the unbounded spinCount to convertPasswdToKey before password verification. When a crafted OLE encrypted-workbook header supplies an excessive spinCount and the file is opened, the key-derivation loop performs unbounded attacker-selected work and cannot be cancelled, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:44 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2389 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/2badfcd… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107219",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:44:53.093795Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:45:16.819Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.3.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes the unbounded spinCount to convertPasswdToKey before password verification. When a crafted OLE encrypted-workbook header supplies an excessive spinCount and the file is opened, the key-derivation loop performs unbounded attacker-selected work and cannot be cancelled, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:33:34.460Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-jrfj-fhj2-jjvm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-jrfj-fhj2-jjvm"
},
{
"name": "https://github.com/qax-os/excelize/pull/2389",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2389"
},
{
"name": "https://github.com/qax-os/excelize/commit/2badfcd5841d0d88b0ffea119f5a2f3c53b4910b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/2badfcd5841d0d88b0ffea119f5a2f3c53b4910b"
}
],
"source": {
"advisory": "GHSA-jrfj-fhj2-jjvm",
"discovery": "UNKNOWN"
},
"title": "Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107219",
"datePublished": "2026-10-07T18:33:34.460Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-07T19:45:16.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107218 (GCVE-0-2026-107218)
Vulnerability from nvd – Published: 2026-10-07 18:29 – Updated: 2026-10-07 22:05
VLAI
EPSS
VEX
Title
Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 22:03 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2390 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/ecd99d7… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107218",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T22:03:39.825103Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T22:05:36.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.10.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:29:38.606Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6"
},
{
"name": "https://github.com/qax-os/excelize/pull/2390",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2390"
},
{
"name": "https://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396"
}
],
"source": {
"advisory": "GHSA-8jjq-8j9w-m2v6",
"discovery": "UNKNOWN"
},
"title": "Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107218",
"datePublished": "2026-10-07T18:29:38.606Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-07T22:05:36.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107217 (GCVE-0-2026-107217)
Vulnerability from nvd – Published: 2026-10-07 18:26 – Updated: 2026-10-08 16:10
VLAI
EPSS
VEX
Title
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column name to wrap to zero with no error. ColumnNameToNumber accepts the overflowing name VGWQHXLSDVIKWV, after which checkSheetR0 and xlsxWorksheet.checkRow use the wrapped column value as an index. When a crafted worksheet uses an overflowing column name in a row normalized by checkSheetR0 or checkRow, the wrapped zero column becomes a negative slice index during worksheet normalization, allowing an attacker to panic and terminate the calling process. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 16:10 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2394 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/696050f… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107217",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T16:10:06.103316Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T16:10:25.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-c85p-xxjj-2r75"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.11.0"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c= 1.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column name to wrap to zero with no error. ColumnNameToNumber accepts the overflowing name VGWQHXLSDVIKWV, after which checkSheetR0 and xlsxWorksheet.checkRow use the wrapped column value as an index. When a crafted worksheet uses an overflowing column name in a row normalized by checkSheetR0 or checkRow, the wrapped zero column becomes a negative slice index during worksheet normalization, allowing an attacker to panic and terminate the calling process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:26:55.998Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-c85p-xxjj-2r75",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-c85p-xxjj-2r75"
},
{
"name": "https://github.com/qax-os/excelize/pull/2394",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2394"
},
{
"name": "https://github.com/qax-os/excelize/commit/696050fbf14e74e96a58eef2b16aaf72f381a6a8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/696050fbf14e74e96a58eef2b16aaf72f381a6a8"
}
],
"source": {
"advisory": "GHSA-c85p-xxjj-2r75",
"discovery": "UNKNOWN"
},
"title": "Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r=\"0\" rows"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107217",
"datePublished": "2026-10-07T18:26:55.998Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-08T16:10:25.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107216 (GCVE-0-2026-107216)
Vulnerability from nvd – Published: 2026-10-07 17:51 – Updated: 2026-10-07 18:51
VLAI
EPSS
VEX
Title
Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypassing in-flight and iteration controls. ANCHORARRAY calls CalcCellValue instead of cellResolver, so each recursive hop receives a new calcContext and loses cycle state. When mutually referencing dynamic-array formulas are evaluated directly or through formula-evaluating APIs, each recursion hop resets the cycle budget and prevents completion-based caches from breaking the cycle, allowing an attacker to cause a fatal Go stack overflow and abort the process. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 18:50 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/commit/ea12859… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107216",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T18:50:55.568606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:51:04.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.8.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypassing in-flight and iteration controls. ANCHORARRAY calls CalcCellValue instead of cellResolver, so each recursive hop receives a new calcContext and loses cycle state. When mutually referencing dynamic-array formulas are evaluated directly or through formula-evaluating APIs, each recursion hop resets the cycle budget and prevents completion-based caches from breaking the cycle, allowing an attacker to cause a fatal Go stack overflow and abort the process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:51:31.980Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-wp2g-vpjj-g53r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-wp2g-vpjj-g53r"
},
{
"name": "https://github.com/qax-os/excelize/commit/ea12859e43c64d498ecf839263c5f917391f3316",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/ea12859e43c64d498ecf839263c5f917391f3316"
}
],
"source": {
"advisory": "GHSA-wp2g-vpjj-g53r",
"discovery": "UNKNOWN"
},
"title": "Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107216",
"datePublished": "2026-10-07T17:51:31.980Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-07T18:51:04.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107215 (GCVE-0-2026-107215)
Vulnerability from nvd – Published: 2026-10-07 17:48 – Updated: 2026-10-10 02:38
VLAI
EPSS
VEX
Title
Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 02:38 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2396 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/5f636f9… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107215",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T02:38:08.709822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T02:38:31.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.3.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:48:03.233Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f"
},
{
"name": "https://github.com/qax-os/excelize/pull/2396",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2396"
},
{
"name": "https://github.com/qax-os/excelize/commit/5f636f9dcde55911f14290060b017f0cc88cd694",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/5f636f9dcde55911f14290060b017f0cc88cd694"
}
],
"source": {
"advisory": "GHSA-x2q3-8cjh-766f",
"discovery": "UNKNOWN"
},
"title": "Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107215",
"datePublished": "2026-10-07T17:48:03.233Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-10T02:38:31.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107214 (GCVE-0-2026-107214)
Vulnerability from nvd – Published: 2026-10-07 17:45 – Updated: 2026-10-07 19:46
VLAI
EPSS
VEX
Title
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values. Decrypt passes attacker-controlled EncryptionInfo and EncryptedPackage data into standardDecrypt or agileDecrypt before validating the structures used by those routines. When a malformed OLE compound file with a version-valid EncryptionInfo stream is opened or passed to Decrypt, nine malformed-input classes reach unrecovered Go runtime panics instead of the documented error path, allowing an attacker to terminate the calling process. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:45 UTC
CWE
- CWE-248 - Uncaught Exception
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2395 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/22f76f9… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107214",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:45:56.602078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:46:20.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-2j4c-ffch-9f23"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.3.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values. Decrypt passes attacker-controlled EncryptionInfo and EncryptedPackage data into standardDecrypt or agileDecrypt before validating the structures used by those routines. When a malformed OLE compound file with a version-valid EncryptionInfo stream is opened or passed to Decrypt, nine malformed-input classes reach unrecovered Go runtime panics instead of the documented error path, allowing an attacker to terminate the calling process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:45:14.274Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-2j4c-ffch-9f23",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-2j4c-ffch-9f23"
},
{
"name": "https://github.com/qax-os/excelize/pull/2395",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2395"
},
{
"name": "https://github.com/qax-os/excelize/commit/22f76f9acb94b85b3eb9c4365ab4f750cebbc565",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/22f76f9acb94b85b3eb9c4365ab4f750cebbc565"
}
],
"source": {
"advisory": "GHSA-2j4c-ffch-9f23",
"discovery": "UNKNOWN"
},
"title": "Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107214",
"datePublished": "2026-10-07T17:45:14.274Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-07T19:46:20.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107213 (GCVE-0-2026-107213)
Vulnerability from nvd – Published: 2026-10-07 17:40 – Updated: 2026-10-07 22:05
VLAI
EPSS
VEX
Title
Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. File.GetSlicers reads ws.Drawing.RID after seeing a worksheet extLst element even when the independently optional worksheet drawing element is absent. When a crafted worksheet contains an extLst element without a drawing element and the application calls GetSlicers, the nil ws.Drawing pointer is dereferenced while resolving the drawing relationship, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 22:00 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2434 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/8ffeb07… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107213",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T22:00:03.455612Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T22:05:46.475Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.9.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. File.GetSlicers reads ws.Drawing.RID after seeing a worksheet extLst element even when the independently optional worksheet drawing element is absent. When a crafted worksheet contains an extLst element without a drawing element and the application calls GetSlicers, the nil ws.Drawing pointer is dereferenced while resolving the drawing relationship, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:40:29.865Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-r7x5-4969-99p7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-r7x5-4969-99p7"
},
{
"name": "https://github.com/qax-os/excelize/pull/2434",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2434"
},
{
"name": "https://github.com/qax-os/excelize/commit/8ffeb07ec9a350410f6922313f6b7e4f5cc79241",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/8ffeb07ec9a350410f6922313f6b7e4f5cc79241"
}
],
"source": {
"advisory": "GHSA-r7x5-4969-99p7",
"discovery": "UNKNOWN"
},
"title": "Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107213",
"datePublished": "2026-10-07T17:40:29.865Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-07T22:05:46.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107212 (GCVE-0-2026-107212)
Vulnerability from nvd – Published: 2026-10-07 17:29 – Updated: 2026-10-07 17:57
VLAI
EPSS
VEX
Title
Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 17:56 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2438 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/01a9ff3… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107212",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T17:56:16.346533Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:57:08.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.1.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:29:23.737Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3"
},
{
"name": "https://github.com/qax-os/excelize/pull/2438",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2438"
},
{
"name": "https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23"
}
],
"source": {
"advisory": "GHSA-jw42-f3rr-4cc3",
"discovery": "UNKNOWN"
},
"title": "Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107212",
"datePublished": "2026-10-07T17:29:23.737Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-07T17:57:08.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107211 (GCVE-0-2026-107211)
Vulnerability from nvd – Published: 2026-10-07 17:11 – Updated: 2026-10-07 19:03
VLAI
EPSS
VEX
Title
Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while processing GetPivotTables and trusts the dataField fld attribute as an index. When a crafted workbook supplies a pivot-field count mismatch or an out-of-range dataField fld value before GetPivotTables is called, the unchecked index causes a Go slice-bounds panic that escapes the library, allowing an attacker to crash the process or request worker. No fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:03 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2435 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/6258dce… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107211",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:03:04.540488Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:03:18.640Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.8.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while processing GetPivotTables and trusts the dataField fld attribute as an index. When a crafted workbook supplies a pivot-field count mismatch or an out-of-range dataField fld value before GetPivotTables is called, the unchecked index causes a Go slice-bounds panic that escapes the library, allowing an attacker to crash the process or request worker. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:11:17.902Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-mx22-3794-2vpv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-mx22-3794-2vpv"
},
{
"name": "https://github.com/qax-os/excelize/pull/2435",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2435"
},
{
"name": "https://github.com/qax-os/excelize/commit/6258dcebc4e2a2aed985c38a08098dfd908521d1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/6258dcebc4e2a2aed985c38a08098dfd908521d1"
}
],
"source": {
"advisory": "GHSA-mx22-3794-2vpv",
"discovery": "UNKNOWN"
},
"title": "Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107211",
"datePublished": "2026-10-07T17:11:17.902Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-07T19:03:18.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107225 (GCVE-0-2026-107225)
Vulnerability from cvelistv5 – Published: 2026-10-07 18:55 – Updated: 2026-10-10 02:42
VLAI
EPSS
VEX
Title
Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 02:41 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2367 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/ae2113b… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107225",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T02:41:58.921948Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T02:42:21.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.8.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle\u0027s fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:55:55.603Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65"
},
{
"name": "https://github.com/qax-os/excelize/pull/2367",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2367"
},
{
"name": "https://github.com/qax-os/excelize/commit/ae2113b410e51f6a141c396a59eda8c42b91bc22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/ae2113b410e51f6a141c396a59eda8c42b91bc22"
}
],
"source": {
"advisory": "GHSA-5h23-36rv-pm65",
"discovery": "UNKNOWN"
},
"title": "Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107225",
"datePublished": "2026-10-07T18:55:55.603Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-10T02:42:21.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107224 (GCVE-0-2026-107224)
Vulnerability from cvelistv5 – Published: 2026-10-07 18:53 – Updated: 2026-10-07 19:30
VLAI
EPSS
VEX
Title
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:29 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2369 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/db93f8d… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107224",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:29:38.692124Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:30:13.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.1.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-681",
"description": "CWE-681: Incorrect Conversion between Numeric Types",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:53:27.282Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw"
},
{
"name": "https://github.com/qax-os/excelize/pull/2369",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2369"
},
{
"name": "https://github.com/qax-os/excelize/commit/db93f8d89de71589069a54d1b998af02e3c5f7cd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/db93f8d89de71589069a54d1b998af02e3c5f7cd"
}
],
"source": {
"advisory": "GHSA-fw94-4wwp-w8pw",
"discovery": "UNKNOWN"
},
"title": "Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107224",
"datePublished": "2026-10-07T18:53:27.282Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-07T19:30:13.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107223 (GCVE-0-2026-107223)
Vulnerability from cvelistv5 – Published: 2026-10-07 18:48 – Updated: 2026-10-07 22:05
VLAI
EPSS
VEX
Title
Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 22:03 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2370 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/a54c578… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107223",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T22:03:57.126591Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T22:05:27.449Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.1.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:48:54.172Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-fq3v-74gv-27gm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-fq3v-74gv-27gm"
},
{
"name": "https://github.com/qax-os/excelize/pull/2370",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2370"
},
{
"name": "https://github.com/qax-os/excelize/commit/a54c578af309fa81f448143ed2b7a91192cc58a7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/a54c578af309fa81f448143ed2b7a91192cc58a7"
}
],
"source": {
"advisory": "GHSA-fq3v-74gv-27gm",
"discovery": "UNKNOWN"
},
"title": "Excelize: Unbounded \u003ccol max\u003e attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107223",
"datePublished": "2026-10-07T18:48:54.172Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-07T22:05:27.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107222 (GCVE-0-2026-107222)
Vulnerability from cvelistv5 – Published: 2026-10-07 18:45 – Updated: 2026-10-08 16:09
VLAI
EPSS
VEX
Title
Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 16:09 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2375 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/be7a163… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107222",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T16:09:18.703933Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T16:09:37.888Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.7.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:45:20.249Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr"
},
{
"name": "https://github.com/qax-os/excelize/pull/2375",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2375"
},
{
"name": "https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd"
}
],
"source": {
"advisory": "GHSA-rxcj-4pj5-74gr",
"discovery": "UNKNOWN"
},
"title": "Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107222",
"datePublished": "2026-10-07T18:45:20.249Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-08T16:09:37.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107221 (GCVE-0-2026-107221)
Vulnerability from cvelistv5 – Published: 2026-10-07 18:41 – Updated: 2026-10-07 19:17
VLAI
EPSS
VEX
Title
Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and checkRow, where targetList is too short for an earlier out-of-order cell. When a crafted row places a higher-column cell before a lower-column final cell and a non-streaming worksheet API reads the sheet, the earlier cell's column index exceeds the slice length derived from the final cell, allowing an attacker to cause an unrecovered panic and terminate the process. No fixed version is available as of this review.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:17 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2376 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/46a5eb2… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107221",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:17:00.546092Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:17:06.445Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-8mcq-6wmr-jrjv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and checkRow, where targetList is too short for an earlier out-of-order cell. When a crafted row places a higher-column cell before a lower-column final cell and a non-streaming worksheet API reads the sheet, the earlier cell\u0027s column index exceeds the slice length derived from the final cell, allowing an attacker to cause an unrecovered panic and terminate the process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:41:46.047Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-8mcq-6wmr-jrjv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-8mcq-6wmr-jrjv"
},
{
"name": "https://github.com/qax-os/excelize/pull/2376",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2376"
},
{
"name": "https://github.com/qax-os/excelize/commit/46a5eb289448e40fbc7d3294589b03861fb822f0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/46a5eb289448e40fbc7d3294589b03861fb822f0"
}
],
"source": {
"advisory": "GHSA-8mcq-6wmr-jrjv",
"discovery": "UNKNOWN"
},
"title": "Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107221",
"datePublished": "2026-10-07T18:41:46.047Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-07T19:17:06.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107220 (GCVE-0-2026-107220)
Vulnerability from cvelistv5 – Published: 2026-10-07 18:37 – Updated: 2026-10-10 02:41
VLAI
EPSS
VEX
Title
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 02:39 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2379 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/99903a3… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107220",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T02:39:12.566271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T02:41:14.449Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.7.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:37:52.712Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff"
},
{
"name": "https://github.com/qax-os/excelize/pull/2379",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2379"
},
{
"name": "https://github.com/qax-os/excelize/commit/99903a3240e58a47ff28fb8e05a03bd9d496ec24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/99903a3240e58a47ff28fb8e05a03bd9d496ec24"
}
],
"source": {
"advisory": "GHSA-g27h-8qhm-6pff",
"discovery": "UNKNOWN"
},
"title": "Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107220",
"datePublished": "2026-10-07T18:37:52.712Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-10T02:41:14.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107219 (GCVE-0-2026-107219)
Vulnerability from cvelistv5 – Published: 2026-10-07 18:33 – Updated: 2026-10-07 19:45
VLAI
EPSS
VEX
Title
Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes the unbounded spinCount to convertPasswdToKey before password verification. When a crafted OLE encrypted-workbook header supplies an excessive spinCount and the file is opened, the key-derivation loop performs unbounded attacker-selected work and cannot be cancelled, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:44 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2389 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/2badfcd… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107219",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:44:53.093795Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:45:16.819Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.3.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes the unbounded spinCount to convertPasswdToKey before password verification. When a crafted OLE encrypted-workbook header supplies an excessive spinCount and the file is opened, the key-derivation loop performs unbounded attacker-selected work and cannot be cancelled, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:33:34.460Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-jrfj-fhj2-jjvm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-jrfj-fhj2-jjvm"
},
{
"name": "https://github.com/qax-os/excelize/pull/2389",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2389"
},
{
"name": "https://github.com/qax-os/excelize/commit/2badfcd5841d0d88b0ffea119f5a2f3c53b4910b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/2badfcd5841d0d88b0ffea119f5a2f3c53b4910b"
}
],
"source": {
"advisory": "GHSA-jrfj-fhj2-jjvm",
"discovery": "UNKNOWN"
},
"title": "Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107219",
"datePublished": "2026-10-07T18:33:34.460Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-07T19:45:16.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107218 (GCVE-0-2026-107218)
Vulnerability from cvelistv5 – Published: 2026-10-07 18:29 – Updated: 2026-10-07 22:05
VLAI
EPSS
VEX
Title
Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 22:03 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2390 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/ecd99d7… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107218",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T22:03:39.825103Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T22:05:36.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.10.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:29:38.606Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6"
},
{
"name": "https://github.com/qax-os/excelize/pull/2390",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2390"
},
{
"name": "https://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396"
}
],
"source": {
"advisory": "GHSA-8jjq-8j9w-m2v6",
"discovery": "UNKNOWN"
},
"title": "Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107218",
"datePublished": "2026-10-07T18:29:38.606Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-07T22:05:36.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107217 (GCVE-0-2026-107217)
Vulnerability from cvelistv5 – Published: 2026-10-07 18:26 – Updated: 2026-10-08 16:10
VLAI
EPSS
VEX
Title
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column name to wrap to zero with no error. ColumnNameToNumber accepts the overflowing name VGWQHXLSDVIKWV, after which checkSheetR0 and xlsxWorksheet.checkRow use the wrapped column value as an index. When a crafted worksheet uses an overflowing column name in a row normalized by checkSheetR0 or checkRow, the wrapped zero column becomes a negative slice index during worksheet normalization, allowing an attacker to panic and terminate the calling process. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 16:10 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2394 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/696050f… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107217",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T16:10:06.103316Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T16:10:25.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-c85p-xxjj-2r75"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c= 2.11.0"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c= 1.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column name to wrap to zero with no error. ColumnNameToNumber accepts the overflowing name VGWQHXLSDVIKWV, after which checkSheetR0 and xlsxWorksheet.checkRow use the wrapped column value as an index. When a crafted worksheet uses an overflowing column name in a row normalized by checkSheetR0 or checkRow, the wrapped zero column becomes a negative slice index during worksheet normalization, allowing an attacker to panic and terminate the calling process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:26:55.998Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-c85p-xxjj-2r75",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-c85p-xxjj-2r75"
},
{
"name": "https://github.com/qax-os/excelize/pull/2394",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2394"
},
{
"name": "https://github.com/qax-os/excelize/commit/696050fbf14e74e96a58eef2b16aaf72f381a6a8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/696050fbf14e74e96a58eef2b16aaf72f381a6a8"
}
],
"source": {
"advisory": "GHSA-c85p-xxjj-2r75",
"discovery": "UNKNOWN"
},
"title": "Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r=\"0\" rows"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107217",
"datePublished": "2026-10-07T18:26:55.998Z",
"dateReserved": "2026-10-07T14:34:14.816Z",
"dateUpdated": "2026-10-08T16:10:25.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107216 (GCVE-0-2026-107216)
Vulnerability from cvelistv5 – Published: 2026-10-07 17:51 – Updated: 2026-10-07 18:51
VLAI
EPSS
VEX
Title
Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypassing in-flight and iteration controls. ANCHORARRAY calls CalcCellValue instead of cellResolver, so each recursive hop receives a new calcContext and loses cycle state. When mutually referencing dynamic-array formulas are evaluated directly or through formula-evaluating APIs, each recursion hop resets the cycle budget and prevents completion-based caches from breaking the cycle, allowing an attacker to cause a fatal Go stack overflow and abort the process. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 18:50 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/commit/ea12859… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107216",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T18:50:55.568606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T18:51:04.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.8.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypassing in-flight and iteration controls. ANCHORARRAY calls CalcCellValue instead of cellResolver, so each recursive hop receives a new calcContext and loses cycle state. When mutually referencing dynamic-array formulas are evaluated directly or through formula-evaluating APIs, each recursion hop resets the cycle budget and prevents completion-based caches from breaking the cycle, allowing an attacker to cause a fatal Go stack overflow and abort the process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:51:31.980Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-wp2g-vpjj-g53r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-wp2g-vpjj-g53r"
},
{
"name": "https://github.com/qax-os/excelize/commit/ea12859e43c64d498ecf839263c5f917391f3316",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/ea12859e43c64d498ecf839263c5f917391f3316"
}
],
"source": {
"advisory": "GHSA-wp2g-vpjj-g53r",
"discovery": "UNKNOWN"
},
"title": "Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107216",
"datePublished": "2026-10-07T17:51:31.980Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-07T18:51:04.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107215 (GCVE-0-2026-107215)
Vulnerability from cvelistv5 – Published: 2026-10-07 17:48 – Updated: 2026-10-10 02:38
VLAI
EPSS
VEX
Title
Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 02:38 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2396 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/5f636f9… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107215",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T02:38:08.709822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T02:38:31.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.3.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:48:03.233Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f"
},
{
"name": "https://github.com/qax-os/excelize/pull/2396",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2396"
},
{
"name": "https://github.com/qax-os/excelize/commit/5f636f9dcde55911f14290060b017f0cc88cd694",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/5f636f9dcde55911f14290060b017f0cc88cd694"
}
],
"source": {
"advisory": "GHSA-x2q3-8cjh-766f",
"discovery": "UNKNOWN"
},
"title": "Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107215",
"datePublished": "2026-10-07T17:48:03.233Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-10T02:38:31.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107214 (GCVE-0-2026-107214)
Vulnerability from cvelistv5 – Published: 2026-10-07 17:45 – Updated: 2026-10-07 19:46
VLAI
EPSS
VEX
Title
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values. Decrypt passes attacker-controlled EncryptionInfo and EncryptedPackage data into standardDecrypt or agileDecrypt before validating the structures used by those routines. When a malformed OLE compound file with a version-valid EncryptionInfo stream is opened or passed to Decrypt, nine malformed-input classes reach unrecovered Go runtime panics instead of the documented error path, allowing an attacker to terminate the calling process. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:45 UTC
CWE
- CWE-248 - Uncaught Exception
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2395 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/22f76f9… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107214",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:45:56.602078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:46:20.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-2j4c-ffch-9f23"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.3.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values. Decrypt passes attacker-controlled EncryptionInfo and EncryptedPackage data into standardDecrypt or agileDecrypt before validating the structures used by those routines. When a malformed OLE compound file with a version-valid EncryptionInfo stream is opened or passed to Decrypt, nine malformed-input classes reach unrecovered Go runtime panics instead of the documented error path, allowing an attacker to terminate the calling process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:45:14.274Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-2j4c-ffch-9f23",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-2j4c-ffch-9f23"
},
{
"name": "https://github.com/qax-os/excelize/pull/2395",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2395"
},
{
"name": "https://github.com/qax-os/excelize/commit/22f76f9acb94b85b3eb9c4365ab4f750cebbc565",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/22f76f9acb94b85b3eb9c4365ab4f750cebbc565"
}
],
"source": {
"advisory": "GHSA-2j4c-ffch-9f23",
"discovery": "UNKNOWN"
},
"title": "Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107214",
"datePublished": "2026-10-07T17:45:14.274Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-07T19:46:20.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107213 (GCVE-0-2026-107213)
Vulnerability from cvelistv5 – Published: 2026-10-07 17:40 – Updated: 2026-10-07 22:05
VLAI
EPSS
VEX
Title
Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. File.GetSlicers reads ws.Drawing.RID after seeing a worksheet extLst element even when the independently optional worksheet drawing element is absent. When a crafted worksheet contains an extLst element without a drawing element and the application calls GetSlicers, the nil ws.Drawing pointer is dereferenced while resolving the drawing relationship, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 22:00 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2434 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/8ffeb07… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107213",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T22:00:03.455612Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T22:05:46.475Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.9.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. File.GetSlicers reads ws.Drawing.RID after seeing a worksheet extLst element even when the independently optional worksheet drawing element is absent. When a crafted worksheet contains an extLst element without a drawing element and the application calls GetSlicers, the nil ws.Drawing pointer is dereferenced while resolving the drawing relationship, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:40:29.865Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-r7x5-4969-99p7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-r7x5-4969-99p7"
},
{
"name": "https://github.com/qax-os/excelize/pull/2434",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2434"
},
{
"name": "https://github.com/qax-os/excelize/commit/8ffeb07ec9a350410f6922313f6b7e4f5cc79241",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/8ffeb07ec9a350410f6922313f6b7e4f5cc79241"
}
],
"source": {
"advisory": "GHSA-r7x5-4969-99p7",
"discovery": "UNKNOWN"
},
"title": "Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107213",
"datePublished": "2026-10-07T17:40:29.865Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-07T22:05:46.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107212 (GCVE-0-2026-107212)
Vulnerability from cvelistv5 – Published: 2026-10-07 17:29 – Updated: 2026-10-07 17:57
VLAI
EPSS
VEX
Title
Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 17:56 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2438 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/01a9ff3… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107212",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T17:56:16.346533Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:57:08.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.1.0, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:29:23.737Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3"
},
{
"name": "https://github.com/qax-os/excelize/pull/2438",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2438"
},
{
"name": "https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23"
}
],
"source": {
"advisory": "GHSA-jw42-f3rr-4cc3",
"discovery": "UNKNOWN"
},
"title": "Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107212",
"datePublished": "2026-10-07T17:29:23.737Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-07T17:57:08.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107211 (GCVE-0-2026-107211)
Vulnerability from cvelistv5 – Published: 2026-10-07 17:11 – Updated: 2026-10-07 19:03
VLAI
EPSS
VEX
Title
Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
Summary
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while processing GetPivotTables and trusts the dataField fld attribute as an index. When a crafted workbook supplies a pivot-field count mismatch or an out-of-range dataField fld value before GetPivotTables is called, the unchecked index causes a Go slice-bounds panic that escapes the library, allowing an attacker to crash the process or request worker. No fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:03 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/qax-os/excelize/security/advis… | x_refsource_CONFIRM |
| https://github.com/qax-os/excelize/pull/2435 | x_refsource_MISC |
| https://github.com/qax-os/excelize/commit/6258dce… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107211",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:03:04.540488Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:03:18.640Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "excelize",
"vendor": "qax-os",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.8.1, \u003c= 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while processing GetPivotTables and trusts the dataField fld attribute as an index. When a crafted workbook supplies a pivot-field count mismatch or an out-of-range dataField fld value before GetPivotTables is called, the unchecked index causes a Go slice-bounds panic that escapes the library, allowing an attacker to crash the process or request worker. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:11:17.902Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qax-os/excelize/security/advisories/GHSA-mx22-3794-2vpv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-mx22-3794-2vpv"
},
{
"name": "https://github.com/qax-os/excelize/pull/2435",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/pull/2435"
},
{
"name": "https://github.com/qax-os/excelize/commit/6258dcebc4e2a2aed985c38a08098dfd908521d1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qax-os/excelize/commit/6258dcebc4e2a2aed985c38a08098dfd908521d1"
}
],
"source": {
"advisory": "GHSA-mx22-3794-2vpv",
"discovery": "UNKNOWN"
},
"title": "Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107211",
"datePublished": "2026-10-07T17:11:17.902Z",
"dateReserved": "2026-10-07T14:34:14.815Z",
"dateUpdated": "2026-10-07T19:03:18.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}