CVE-2026-128344

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages...

CVE-2026-128344

The ExcelJS library (through version 4.4.0 ) is vulnerable to a memory exhaustion (CWE-770) flaw. An attacker can crash applications by providing a workbook containing an unbounded image anchor column within the drawing part (e.g., setting an anchor column like 300000000 in xl/drawings/drawing1.x...

CVE-2026-128344 ExcelJS through 4.4.0 Memory Exhaustion via Oversized Image Anchor Column

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages...

EUVD-2026-125155

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages...