GO-2026-6687 Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize

Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize...

GO-2026-6688 Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize

Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize...

GO-2026-6689 Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize

Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize...

PT-2026-118007

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelize...

PT-2026-118017

Panic via unchecked pivot-cache field index in github.com/xuri/excelize/v2...

PT-2026-118010

Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize...

PT-2026-118006

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelize...

PT-2026-118011

Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize...

PT-2026-118009

Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize...

EUVD-2026-94526

Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic...

GHSA-MX22-3794-2VPV Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

Summary extractPivotTableFields builds order := pc.getPivotCacheFieldsName from xl/pivotCache/pivotCacheDefinitionN.xml's list, then indexes it with values taken from a separately parsed xl/pivotTables/pivotTableN.xml part with zero cross-validation: orderfield.Fld where field.Fld is a raw...

Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

Summary extractPivotTableFields builds order := pc.getPivotCacheFieldsName from xl/pivotCache/pivotCacheDefinitionN.xml's list, then indexes it with values taken from a separately parsed xl/pivotTables/pivotTableN.xml part with zero cross-validation: orderfield.Fld where field.Fld is a raw...

GHSA-JW42-F3RR-4CC3 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

Summary A worksheet whose number is far past Excel's 1,048,576-row limit makes File.GetRows and the Rows iterator loop once for every missing row. The row limit is checked in Rows.Next, but not in Rows.Columns, which also reads elements. A 1.5 KB file with after an ordinary first row keeps GetRow...

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

Summary A worksheet whose number is far past Excel's 1,048,576-row limit makes File.GetRows and the Rows iterator loop once for every missing row. The row limit is checked in Rows.Next, but not in Rows.Columns, which also reads elements. A 1.5 KB file with after an ordinary first row keeps GetRow...

EUVD-2026-94527

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days...

EUVD-2026-94530

Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element...

Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element

Summary GetSlicers guards only if ws.ExtLst == nil return slicer.go:816-818 and then immediately dereferences ws.Drawing.RID with no nil check on ws.Drawing itself. Drawing and ExtLst are two independently optional child elements of in xl/worksheets/sheetN.xml, populated separately by encoding/xm...

GHSA-R7X5-4969-99P7 Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element

Summary GetSlicers guards only if ws.ExtLst == nil return slicer.go:816-818 and then immediately dereferences ws.Drawing.RID with no nil check on ws.Drawing itself. Drawing and ExtLst are two independently optional child elements of in xl/worksheets/sheetN.xml, populated separately by encoding/xm...

EUVD-2026-94531

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks...

GHSA-2J4C-FFCH-9F23 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

Summary Any file whose first 8 bytes are the OLE compound-file signature D0 CF 11 E0 A1 B1 1A E1 is routed by OpenFile/OpenReader/OpenBytes → openReaderAt → Decrypt. The version dispatch only guarantees lenEncryptionInfo = 4 before handing attacker-controlled EncryptionInfo/EncryptedPackage buffe...