CVE-2026-107219

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...

CVE-2026-107219 Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...

CVE-2026-107219

The Excelize Go language library (versions 2.3.1 to 2.11.0 ) is vulnerable to an uncontrolled resource consumption flaw (CWE-400) during the OpenFile operation. The agileDecrypt function accepts an attacker-controlled spinCount from a crafted OLE encrypted-workbook header and passes it to convert...

EUVD-2026-94549

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...