{"id":"CVE-2026-107214","kind":"vulnerability","aliases":["CVE-2026-107214","GHSA-2j4c-ffch-9f23","GO-2026-6684"],"related":[],"title":"Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelize","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values. Decrypt passes attacker-controlled EncryptionInfo and EncryptedPackage data into standardDecrypt or agileDecrypt before validating the structures used by those routines. When a malformed OLE compound file with a version-valid EncryptionInfo stream is opened or passed to Decrypt, nine malformed-input classes reach unrecovered Go runtime panics instead of the documented error path, allowing an attacker to terminate the calling process. No fixed version is available as of this review.","summary":"The Excelize Go library panics on malformed encrypted OLE/CFB Excel workbooks when they are opened or passed to its Decrypt function, instead of returning an error. An attacker who supplies such a file can crash the process that calls the library.","severity":"high","cvss":7.5,"epss":0.00244,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/360EntSecGroup-Skylar/excelize/v2","fixed":[],"affected":">= 2.3.1","ecosystem":"go"},{"name":"github.com/xuri/excelize/v2","fixed":["2.11.1-0.20260915055537-22f76f9acb94"],"affected":"< 2.11.1-0.20260915055537-22f76f9acb94","ecosystem":"go"}],"ecosystems":["go"],"tags":["excelize","file-upload","go","package","self-hosted"],"not_affected_if":["no-untrusted-decrypt","version-above-2.11.0","version-below-2.3.1"],"how_to_check":"Run `go list -m github.com/xuri/excelize/v2` in each Go module and check whether the version falls between 2.3.1 and 2.11.0.\nAlso check for the older module path github.com/360EntSecGroup-Skylar/excelize/v2 from 2.3.1 onward.","fix":"Move github.com/xuri/excelize/v2 to 2.11.1-0.20260915055537-22f76f9acb94 or later, per the govuln fixed-version data.\nThe description says no fixed version was available at review, so confirm on https://pkg.go.dev/vuln/GO-2026-6684 before relying on that version.","status":"open","published_at":"2026-10-07T18:17:19+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:13+00:00","updated_at":"2026-10-23T19:56:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:56:13Z","model":"claude-haiku-5-5","output":{"fix":"Move github.com/xuri/excelize/v2 to 2.11.1-0.20260915055537-22f76f9acb94 or later, per the govuln fixed-version data.\nThe description says no fixed version was available at review, so confirm on https://pkg.go.dev/vuln/GO-2026-6684 before relying on that version.","summary":"The Excelize Go library panics on malformed encrypted OLE/CFB Excel workbooks when they are opened or passed to its Decrypt function, instead of returning an error. An attacker who supplies such a file can crash the process that calls the library.","category":"package","who_cares":["go","excelize","self-hosted","file-upload"],"confidence":0.7,"analyst_note":"Sources conflict: govuln lists 2.11.1-0.20260915055537-22f76f9acb94 as fixed, but the description says no fixed version exists; check https://pkg.go.dev/vuln/GO-2026-6684 and https://nvd.nist.gov/vuln/detail/CVE-2026-107214.","how_to_check":"Run `go list -m github.com/xuri/excelize/v2` in each Go module and check whether the version falls between 2.3.1 and 2.11.0.\nAlso check for the older module path github.com/360EntSecGroup-Skylar/excelize/v2 from 2.3.1 onward.","needs_analyst":true,"not_affected_if":["version-below-2.3.1","version-above-2.11.0","no-untrusted-decrypt"],"severity_if_unknown":"high"},"cost_usd":0.000854,"input_tokens":2398,"output_tokens":1229,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107214':16A,27A '-2026':15A,23A,26A '-6684':24A '/360entsecgroup-skylar/excelize/v2':30A '/xuri/excelize':13A '/xuri/excelize/v2':33A '2.11.0':100C '2.3.1':98C '2j4c':19A '9f23':21A 'agil':113C 'agiledecrypt':137C 'alloc':117C 'allow':181C 'attack':70B,122C,128C,183C 'attacker-control':121C,127C 'avail':193C 'call':81B,187C 'class':169C 'compound':150C 'control':123C,129C 'crash':77B 'cve':14A,25A 'data':133C 'decrypt':2A,62B,102C,125C,164C 'decryptor':114C 'dispatch':103C 'divid':119C 'document':178C 'encrypt':8A,50B 'encryptedpackag':132C 'encryptioninfo':130C,157C 'error':68B,179C 'excel':1A,34B,44B,52B,84C,95C 'ffch':20A 'file':36B,75B,151C 'file-upload':35B 'fix':190C 'function':63B 'ghsa':18A 'ghsa-2j4c-ffch-9f23':17A 'github.com':12A,29A,32A 'github.com/360entsecgroup-skylar/excelize/v2':28A 'github.com/xuri/excelize':11A 'github.com/xuri/excelize/v2':31A 'go':22A,38B,45B,87C,172C 'host':42B 'index':116C 'input':168C 'instead':64B,175C 'insuffici':105C 'languag':88C 'librari':46B,83B,89C 'malform':6A,49B,148C,167C 'malformed-input':166C 'microsoft':94C 'nine':165C 'ole':149C 'ole/cfb':7A,51B 'open':57B,160C 'packag':39B 'panic':4A,47B,174C 'paramet':108C 'pass':59B,126C,162C 'path':180C 'perform':104C 'process':79B,188C 'reach':170C 'read':91C 'return':66B 'review':197C 'routin':145C 'runtim':173C 'self':41B 'self-host':40B 'slice':115C 'spreadsheet':96C 'standard':111C 'standarddecrypt':135C 'stream':158C 'structur':106C,141C 'suppli':72B 'termin':185C 'unrecov':171C 'unrecover':3A 'upload':37B 'use':120C,142C 'valid':109C,139C,156C 'valu':124C 'version':155C,191C 'version-valid':154C 'workbook':9A,53B 'write':93C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T18:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6684","url":"https://pkg.go.dev/vuln/GO-2026-6684","severity":null,"published_at":"2026-10-19T21:08:21+00:00","modified_at":"2026-10-19T21:08:21+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107214","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107214","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107214","severity":null,"published_at":"2026-10-07T18:17:19+00:00","modified_at":"2026-10-13T14:24:00+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}