Read the docs
TI-2026-69270 Aliases CVE-2026-107221GHSA-8mcq-6wmr-jrjv

Index out of range panic in Excelize reading crafted worksheet rows

Priority MEDIUM 62CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-787 and the CVSS impact.

Summary

Excelize, a Go library for reading and writing Microsoft Excel spreadsheets, is affected from 2.0.0 through 2.11.0. A row whose earlier cell has a higher column reference than its last cell makes checkRow size its slice too short, which causes an out-of-bounds write (CWE-787). When a user reads a crafted spreadsheet with a non-streaming worksheet API such as GetCellValue, an attacker can trigger an unrecovered panic that terminates the process. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and checkRow, where targetList is too short for an earlier out-of-order cell. When a crafted row places a higher-column cell before a lower-column final cell and a non-streaming worksheet API reads the sheet, the earlier cell's column index exceeds the slice length derived from the final cell, allowing an attacker to cause an unrecovered panic and terminate the process. No fixed version is available as of this review.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/xuri/excelize/v2 (Go): 2.11.1-0.20260816084418-46a5eb289448

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
qax-osexcelize2.0.0 – 2.11.0—No fix listedCNA
—github.com/xuri/excelize/v2 (Go)2.0.0 to before 2.11.1-0.20260816084418-46a5eb2894482.11.1-0.20260816084418-46a5eb289448Patch availableGHSA-8mcq-6wmr-jrjv
  • excelize Vendorqax-os Affected 2.0.0 – 2.11.0 Fixed in — No fix listed CNA
  • github.com/xuri/excelize/v2 (Go) Vendor— Affected 2.0.0 to before 2.11.1-0.20260816084418-46a5eb289448 Fixed in 2.11.1-0.20260816084418-46a5eb289448 Patch available GHSA-8mcq-6wmr-jrjv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:*2.0.0 – 2.11.0Vulnerableqax-os
  • cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:* Versions 2.0.0 – 2.11.0 Vulnerable ·qax-os

Remediation

Update github.com/xuri/excelize/v2 to 2.11.1-0.20260816084418-46a5eb289448. The sources list no fixed version for excelize.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · GHSA-8mcq-6wmr-jrjv github.com/xuri/excelize/v2 (Go) Fixed in 2.11.1-0.20260816084418-46a5eb289448 Advisory →

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107221
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Alias added: GHSA-8mcq-6wmr-jrjv
  4. 2026-10-07 Fix available: Go/github.com/xuri/excelize/[email protected] · GHSA-8mcq-6wmr-jrjv
  5. 2026-10-07 CVSS score added · GHSA-8mcq-6wmr-jrjv
  6. 2026-10-07 Weakness changed · GHSA-8mcq-6wmr-jrjv
  7. 2026-10-07 4 new references · GHSA-8mcq-6wmr-jrjv

References

Exploit 1

Patch 2

Other 1

  • TI-2026-42325 Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation CVSS 4.0HIGH 8.7
  • TI-2026-69266 Integer overflow in Excelize column parsing causes process panic CVSS 3.1HIGH 7.5
  • TI-2026-69263 Excelize crafted OLE files cause memory exhaustion and panic CVSS 3.1HIGH 7.5
  • TI-2026-69262 Unrecoverable panics in Excelize Decrypt on malformed OLE workbooks CVSS 3.1HIGH 7.5
  • TI-2026-69260 Unbounded row number in Excelize lets crafted spreadsheets hang reads CVSS 3.1HIGH 7.5
  • TI-2026-38996 Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences