Read the docs
TI-2026-69268 Aliases CVE-2026-107219GHSA-jrfj-fhj2-jjvm

Uncontrolled resource use in Excelize agile decryption exhausts CPU

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Excelize, a Go library for Microsoft Excel spreadsheets, is affected from 2.3.1 through 2.11.0. Agile decryption uses an attacker-controlled spinCount for password key derivation before the password is verified, which is uncontrolled resource consumption (CWE-400). An unauthenticated attacker can craft an encrypted workbook header that makes opening the file consume a CPU core for an attacker-chosen duration. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes the unbounded spinCount to convertPasswdToKey before password verification. When a crafted OLE encrypted-workbook header supplies an excessive spinCount and the file is opened, the key-derivation loop performs unbounded attacker-selected work and cannot be cancelled, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00363 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/xuri/excelize/v2 (Go): 2.11.1-0.20260906004932-2badfcd5841d

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
qax-osexcelize2.3.1 – 2.11.0—No fix listedCNA
—github.com/xuri/excelize/v2 (Go)2.3.1 to before 2.11.1-0.20260906004932-2badfcd5841d2.11.1-0.20260906004932-2badfcd5841dPatch availableGHSA-jrfj-fhj2-jjvm
  • excelize Vendorqax-os Affected 2.3.1 – 2.11.0 Fixed in — No fix listed CNA
  • github.com/xuri/excelize/v2 (Go) Vendor— Affected 2.3.1 to before 2.11.1-0.20260906004932-2badfcd5841d Fixed in 2.11.1-0.20260906004932-2badfcd5841d Patch available GHSA-jrfj-fhj2-jjvm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:*2.3.1 – 2.11.0Vulnerableqax-os
  • cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:* Versions 2.3.1 – 2.11.0 Vulnerable ·qax-os

Remediation

Update the Go module github.com/xuri/excelize/v2 to 2.11.1-0.20260906004932-2badfcd5841d, the fixed version listed for it. The sources list no fixed version for excelize.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · GHSA-jrfj-fhj2-jjvm github.com/xuri/excelize/v2 (Go) Fixed in 2.11.1-0.20260906004932-2badfcd5841d Advisory →

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107219
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Priority changed: MEDIUM → LOW
  4. 2026-10-07 Alias added: GHSA-jrfj-fhj2-jjvm
  5. 2026-10-07 Fix available: Go/github.com/xuri/excelize/[email protected] · GHSA-jrfj-fhj2-jjvm
  6. 2026-10-07 CVSS score added · GHSA-jrfj-fhj2-jjvm
  7. 2026-10-07 Weakness changed · GHSA-jrfj-fhj2-jjvm
  8. 2026-10-07 4 new references · GHSA-jrfj-fhj2-jjvm

References

Exploit 1

Patch 2

Other 1

  • TI-2026-42325 Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation CVSS 4.0HIGH 8.7
  • TI-2026-69266 Integer overflow in Excelize column parsing causes process panic CVSS 3.1HIGH 7.5
  • TI-2026-69263 Excelize crafted OLE files cause memory exhaustion and panic CVSS 3.1HIGH 7.5
  • TI-2026-69262 Unrecoverable panics in Excelize Decrypt on malformed OLE workbooks CVSS 3.1HIGH 7.5
  • TI-2026-69260 Unbounded row number in Excelize lets crafted spreadsheets hang reads CVSS 3.1HIGH 7.5
  • TI-2026-38996 Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences