EUVD-2026-125038

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet.parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load to create billions of...

CVE-2026-128339

The ExcelJS library (through version 4.4.0 ) is vulnerable to a memory exhaustion issue within the Worksheet._parseMergeCells function. An attacker can crash an application by providing a workbook containing an unbounded mergeCell range , such as A1:XFD1048576. When xlsx.load() processes this fil...

CVE-2026-107220

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser...

CVE-2026-107220

The Excelize Go language library (versions 2.7.1 to 2.11.0 ) contains a vulnerability where the mergeCellsParser fails to perform a length check when handling an empty mergeCell ref . Specifically, it passes an empty slice to cellInRange , which is then accessed by GetCellValue . An attacker can ...

CVE-2026-107220 Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser...

CVE-2026-107220 Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser...

CVE-2026-107220 Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser...