EUVD-2026-93554

ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index...

ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

Summary SixLabors.ImageSharp can terminate a process when an application decodes an attacker-supplied 32-bit floating-point TIFF as Image and applies HistogramEqualization. An IEEE positive-infinity TIFF sample reaches a non-finite or otherwise out-of-range HalfVector4 component, depending on the...

Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics

leftRight calc.go:14236 tests the length with countUTF16String, which counts a rune above U+FFFF as 2. The RIGHT branch on 14241 then slices runetext at utf8.RuneCountInStringtext-numChars, which counts it as 1. For text with N such runes the two measures are 2N and N, so any numChars between the...

GHSA-8JJQ-8J9W-M2V6 Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics

leftRight calc.go:14236 tests the length with countUTF16String, which counts a rune above U+FFFF as 2. The RIGHT branch on 14241 then slices runetext at utf8.RuneCountInStringtext-numChars, which counts it as 1. For text with N such runes the two measures are 2N and N, so any numChars between the...

GHSA-G27H-8QHM-6PFF Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

Summary A worksheet containing makes mergeCellsParser leave the cached rectangle empty, and cellInRange then indexes that empty slice without a length check. Every non-streaming cell API panics with index out of range 0 with length 0 on the first cell read after opening the file. Where it is...

Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API

Affected versions and vulnerable location - Confirmed at ae2113b current HEAD. - Sink: rows.go:967 ws.SheetData.RowrowIdx.CcolNum-1 = colData inside checkRow. - checkRow computes lastCol from the column of the last cell in document order rows.go:940, allocates targetList of that length, then...

GHSA-8MCQ-6WMR-JRJV Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API

Affected versions and vulnerable location - Confirmed at ae2113b current HEAD. - Sink: rows.go:967 ws.SheetData.RowrowIdx.CcolNum-1 = colData inside checkRow. - checkRow computes lastCol from the column of the last cell in document order rows.go:940, allocates targetList of that length, then...

GHSA-FW94-4WWP-W8PW Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

Summary A Zip64 uncompressed-size of 2^63 casts to a negative int64 that bypasses the unzip-size guard and reaches makebyte, 0, negativeCap A Zip64 uncompressed-size in the range 2^63, 2^64 casts to a negative int64 in zip.File.FileInfo.Size, and ReadZipReader does signed arithmetic on that value...

CVE-2026-107222

The Excelize Go library, used for reading and writing Microsoft Excel spreadsheets, is vulnerable in versions 2.7.0 to 2.11.0 . The GetConditionalFormats function fails to perform sufficient length or nil checks when extracting conditional-formatting rules. Specifically, it indexes required child...

EUVD-2026-94552

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches...

CVE-2026-107222 Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches...

CVE-2026-107222 Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches...

CVE-2026-107221

The Excelize Go library (versions 2.0.0 to 2.11.0 ) is vulnerable to an out-of-bounds write (CWE-787) during non-streaming worksheet read operations. The root cause lies in the checkRow function, which incorrectly sizes a target cell slice based on the last cell in XML document order. If a crafte...

CVE-2026-107221 Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and...

CVE-2026-107221 Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and...

PT-2026-107658

Name of the Vulnerable Software and Affected Versions Excelize versions 2.7.1 through 2.11.0 Description An issue exists where the mergeCellsParser function fails to perform a length check on a cached rectangle when encountering an empty ref attribute in a crafted worksheet. This empty slice is...

CVE-2026-106113

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

CVE-2026-106113 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

CVE-2026-106113 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

CVE-2026-106113 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...