186 matches found
GO-2026-6689 Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize
Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize...
GO-2026-6687 Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize
Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize...
GO-2026-6688 Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize
Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize...
EUVD-2026-94526
Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic...
GHSA-MX22-3794-2VPV Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
Summary extractPivotTableFields builds order := pc.getPivotCacheFieldsName from xl/pivotCache/pivotCacheDefinitionN.xml's list, then indexes it with values taken from a separately parsed xl/pivotTables/pivotTableN.xml part with zero cross-validation: orderfield.Fld where field.Fld is a raw...
GHSA-JW42-F3RR-4CC3 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
Summary A worksheet whose number is far past Excel's 1,048,576-row limit makes File.GetRows and the Rows iterator loop once for every missing row. The row limit is checked in Rows.Next, but not in Rows.Columns, which also reads elements. A 1.5 KB file with after an ordinary first row keeps GetRow...
EUVD-2026-94527
Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days...
EUVD-2026-94530
Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element...
GHSA-R7X5-4969-99P7 Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
Summary GetSlicers guards only if ws.ExtLst == nil return slicer.go:816-818 and then immediately dereferences ws.Drawing.RID with no nil check on ws.Drawing itself. Drawing and ExtLst are two independently optional child elements of in xl/worksheets/sheetN.xml, populated separately by encoding/xm...
Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
Summary GetSlicers guards only if ws.ExtLst == nil return slicer.go:816-818 and then immediately dereferences ws.Drawing.RID with no nil check on ws.Drawing itself. Drawing and ExtLst are two independently optional child elements of in xl/worksheets/sheetN.xml, populated separately by encoding/xm...
GHSA-2J4C-FFCH-9F23 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
Summary Any file whose first 8 bytes are the OLE compound-file signature D0 CF 11 E0 A1 B1 1A E1 is routed by OpenFile/OpenReader/OpenBytes → openReaderAt → Decrypt. The version dispatch only guarantees lenEncryptionInfo = 4 before handing attacker-controlled EncryptionInfo/EncryptedPackage buffe...
EUVD-2026-94531
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks...
Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
Summary extractPart allocates directly from the mscfb directory-entry size with no clamping crypt.go:198, same missing bound at crypt.go:204: go buf := makebyte, entry.Size entry.Size is the raw streamSize field from the attacker-controlled CFB directory entry mscfb v1.0.8 fixFile, file.go:109-12...
GHSA-X2Q3-8CJH-766F Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
Summary extractPart allocates directly from the mscfb directory-entry size with no clamping crypt.go:198, same missing bound at crypt.go:204: go buf := makebyte, entry.Size entry.Size is the raw streamSize field from the attacker-controlled CFB directory entry mscfb v1.0.8 fixFile, file.go:109-12...
EUVD-2026-94533
Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS...
EUVD-2026-94534
Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow...
GHSA-WP2G-VPJJ-G53R Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
Summary ANCHORARRAY calc.go:15137 on current master evaluates each cell of the referenced spill range by calling the exported CalcCellValue, which unconditionally constructs a fresh calcContext — fresh entry marker, fresh iterations map, full MaxCalcIterations budget calc.go:896-900. The...
Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
Summary ANCHORARRAY calc.go:15137 on current master evaluates each cell of the referenced spill range by calling the exported CalcCellValue, which unconditionally constructs a fresh calcContext — fresh entry marker, fresh iterations map, full MaxCalcIterations budget calc.go:896-900. The...
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
Summary ColumnNameToNumber lib.go:220-237 accumulates the bijective base-26 value of a column name in an int64 with only an upper-bound check col MaxColumns applied after the loop and no overflow detection. A 14-letter column name whose true value is 3·2⁶⁴ — e.g. VGWQHXLSDVIKWV — wraps to col = 0...
GHSA-C85P-XXJJ-2R75 Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
Summary ColumnNameToNumber lib.go:220-237 accumulates the bijective base-26 value of a column name in an int64 with only an upper-bound check col MaxColumns applied after the loop and no overflow detection. A 14-letter column name whose true value is 3·2⁶⁴ — e.g. VGWQHXLSDVIKWV — wraps to col = 0...