PT-2026-107661

Name of the Vulnerable Software and Affected Versions Excelize versions 2.7.0 through 2.11.0 Description An issue exists when extracting conditional formats from a crafted worksheet. The GetConditionalFormats function fails to properly validate the structure of certain rules, specifically cellIs,...

PT-2026-107655

Name of the Vulnerable Software and Affected Versions github.com/xuri/excelize/v2 versions 2.0.0 through 2.11.0 github.com/xuri/excelize versions 1.1.0 through 1.4.1 Description An issue exists where the ColumnNameToNumber function accumulates a bijective base-26 value in an int64 without detecti...

CVE-2026-107216: Uncontrolled Recursion

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypassing in-flight and iteration controls. ANCHORARRAY calls...

PT-2026-107663

Name of the Vulnerable Software and Affected Versions Excelize versions 2.1.0 through 2.11.0 Description An issue exists when processing Zip64 entries where an uncompressed size with the high bit set ranging from 2^63 through 2^64-1 is converted from a uint64 to a negative int64. This conversion...

CVE-2026-107223: Memory Allocation with Excessive Size Value

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max...

PT-2026-107656

Name of the Vulnerable Software and Affected Versions Excelize versions 2.10.1 through 2.11.0 Description An issue exists in the formula evaluation process where the RIGHT function handles text length inconsistently. The software validates the requested length using UTF-16 code-unit counts via th...

CVE-2026-107224: Integer Overflow or Wraparound

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 throu...

CVE-2026-107212: Allocation of Resources Without Limits or Throttling

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes...

CVE-2026-107220: Out-of-bounds Read

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser...

CVE-2026-107217: Integer Overflow or Wraparound

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing a...

CVE-2026-107221: Out-of-bounds Write

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and...

CVE-2026-107222: Improper Validation of Array Index

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches...

CVE-2026-107219: Uncontrolled Resource Consumption

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...

PT-2026-107664

Name of the Vulnerable Software and Affected Versions Excelize versions 2.8.0 through 2.11.0 Description An issue exists in the File.GetStyle function where the library fails to validate the lower bounds of style-table indices extracted from the styles.xml file of a workbook. Specifically, the...

PT-2026-107645

Name of the Vulnerable Software and Affected Versions Excelize versions 2.3.1 through 2.11.0 Description Insufficient structural and parameter validation occurs during the decryption dispatch process. The Decrypt function passes attacker-controlled EncryptionInfo and EncryptedPackage data into...

PT-2026-107646

Name of the Vulnerable Software and Affected Versions Excelize versions 2.3.1 through 2.11.0 Description The extractPart function allocates a byte slice using a CFB directory-entry size provided by the user before validating the sector chain or size domain. Specifically, the function trusts the...

PT-2026-107647

Name of the Vulnerable Software and Affected Versions Excelize versions 2.8.1 through 2.11.0 Description In the Excelize Go library, the ANCHORARRAY function recursively calls the exported CalcCellValue function. This process creates a new calculation context at each cycle, which bypasses iterati...

PT-2026-107659

Name of the Vulnerable Software and Affected Versions Excelize versions 2.0.0 through 2.11.0 Description An issue exists in the checkRow function where the size of the target cell slice is determined by the last cell in the XML document order. If a crafted spreadsheet contains a row where a cell...

CVE-2026-107211: Improper Validation of Array Index

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while...

PT-2026-107642

Name of the Vulnerable Software and Affected Versions Excelize versions 2.8.1 through 2.11.0 Description This issue occurs when separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. The extractPivotTableFields function uses the outpu...