---
id: "CVE-2026-107214"
kind: "vulnerability"
aliases: ["CVE-2026-107214", "GHSA-2j4c-ffch-9f23", "GO-2026-6684"]
title: "Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelize"
severity: "high"
cvss: 7.5
epss: 0.00244
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/360EntSecGroup-Skylar/excelize/v2", "fixed": [], "affected": ">= 2.3.1", "ecosystem": "go"}, {"name": "github.com/xuri/excelize/v2", "fixed": ["2.11.1-0.20260915055537-22f76f9acb94"], "affected": "< 2.11.1-0.20260915055537-22f76f9acb94", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["excelize", "file-upload", "go", "package", "self-hosted"]
not_affected_if: ["no-untrusted-decrypt", "version-above-2.11.0", "version-below-2.3.1"]
published_at: "2026-10-07T18:17:19+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:56:13+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6684", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107214", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107214", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelize

The Excelize Go library panics on malformed encrypted OLE/CFB Excel workbooks when they are opened or passed to its Decrypt function, instead of returning an error. An attacker who supplies such a file can crash the process that calls the library.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/360EntSecGroup-Skylar/excelize/v2 affected >= 2.3.1 fixed ?
- go:github.com/xuri/excelize/v2 affected < 2.11.1-0.20260915055537-22f76f9acb94 fixed 2.11.1-0.20260915055537-22f76f9acb94

## How to check

Run `go list -m github.com/xuri/excelize/v2` in each Go module and check whether the version falls between 2.3.1 and 2.11.0.
Also check for the older module path github.com/360EntSecGroup-Skylar/excelize/v2 from 2.3.1 onward.

## Fix

Move github.com/xuri/excelize/v2 to 2.11.1-0.20260915055537-22f76f9acb94 or later, per the govuln fixed-version data.
The description says no fixed version was available at review, so confirm on https://pkg.go.dev/vuln/GO-2026-6684 before relying on that version.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6684
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-107214
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107214

## From the sources

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values. Decrypt passes attacker-controlled EncryptionInfo and EncryptedPackage data into standardDecrypt or agileDecrypt before validating the structures used by those routines. When a malformed OLE compound file with a version-valid EncryptionInfo stream is opened or passed to Decrypt, nine malformed-input classes reach unrecovered Go runtime panics instead of the documented error path, allowing an attacker to terminate the calling process. No fixed version is available as of this review.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_