CVE-2026-107224 Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 throu...

CVE-2026-107224

The Excelize Go library (versions 2.1.0 to 2.11.0 ) is vulnerable to a panic during workbook opening due to an integer overflow/wraparound . When a crafted Zip64 entry declares an uncompressed size between $2^{63}$ and $2^{64}-1$, the library converts the uint64 value into a negative int64. This ...

EUVD-2026-94555

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 throu...