Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

Opening a file whose first eight bytes are the OLE magic number sends excelize down the decryption path whether or not the caller set a password, or supports encrypted workbooks at all. openReaderAt excelize.go:198-215 branches on the header alone, and agileDecrypt calls convertPasswdToKey before...

GHSA-JRFJ-FHJ2-JJVM Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

Opening a file whose first eight bytes are the OLE magic number sends excelize down the decryption path whether or not the caller set a password, or supports encrypted workbooks at all. openReaderAt excelize.go:198-215 branches on the header alone, and agileDecrypt calls convertPasswdToKey before...

CVE-2026-107219

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...

CVE-2026-107219 Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...

CVE-2026-107219 Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...

EUVD-2026-94549

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...

CVE-2026-107219 Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...

PT-2026-107657

Name of the Vulnerable Software and Affected Versions Excelize versions 2.3.1 through 2.11.0 Description An issue exists in the agile decryption process where the library accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation...

CVE-2026-107219: Uncontrolled Resource Consumption

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...