Live › vulnerability › CVE-2026-107215
Go to dashboardExcelize, a Go library for reading and writing Excel files, allocates memory based on a size field in a crafted OLE compound file without validating it first. An attacker who supplies such a file can crash the process with a panic or exhaust its memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/360EntSecGroup-Skylar/excelize/v2 | go | >= 2.3.1 | – |
| github.com/xuri/excelize/v2 | go | < 2.11.1-0.20260912113515-5f636f9dcde5 | 2.11.1-0.20260912113515-5f636f9dcde5 |
Run go list -m github.com/xuri/excelize/v2 in each service and check the version against the affected range.
Search go.sum for excelize to find transitive copies, including the older github.com/360EntSecGroup-Skylar/excelize/v2 path.
If services parse user-uploaded .xlsx files, flag them as exposed.
2.11.1-0.20260912113515-5f636f9dcde5 or later, per the product dataEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review.
This page as .md · .json · in your agent: get_signal("CVE-2026-107215")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.