{"id":"CVE-2026-107217","kind":"vulnerability","aliases":["CVE-2026-107217","GHSA-c85p-xxjj-2r75","GO-2026-6677"],"related":[],"title":"Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r=\"0\" rows","description":"### Summary\n\n`ColumnNameToNumber` (lib.go:220-237) accumulates the bijective base-26 value of a column name in an int64 with only an upper-bound check (`col > MaxColumns`) applied after the loop and no overflow detection. A 14-letter column name whose true value is 3·2⁶⁴ — e.g. **`VGWQHXLSDVIKWV`** — wraps to `col = 0` and passes the guard, so `CellNameToCoordinates(\"VGWQHXLSDVIKWV1\")` returns `(col=0, row=1, err=nil)`.\n\nWhen normalizing a `r=\"0\"` row, `checkSheetR0` (excelize.go:417-443, called from `checkSheet` at excelize.go:405) runs its `checkRow` closure with `col = 0`: `colIdx := col - 1` becomes **-1**, and `sheetData.Row[rowIdx].C[-1]` (excelize.go:424) raises an unrecovered `panic: runtime error: index out of range [-1]`, killing the host process.\n\n### Details\n\n- The row side of the same coordinate gate is enforced (`checkRowNum` at excelize.go:342-350 bounds `r` before the `make([]xlsxRow, row)` allocation; this includes the fix for GHSA-h69g-9hx6-f3v4 / CVE-2026-54063, present in the audited commit). The **column** side is not: `checkSheet`/`lastRowNum`/`checkSheetR0` treat `err == nil` from `CellNameToCoordinates` as proof of an in-domain coordinate (excelize.go:356, :438), which is unsound because of the wrap-around above.\n- The same unsound gate also feeds `ws.SheetData.Row[rowIdx].C[colNum-1]` in `xlsxWorksheet.checkRow` (rows.go:969): a row combining a valid large column (e.g. `XFD1`) with an overflowed column panics identically.\n- Reachable from any `workSheetReader`-based API on an attacker-supplied worksheet: `GetCellValue`, `GetCellFormula`, `SetCellValue`, `GetMergeCells`, `GetSheetDimension`, `GetColWidth`, `AddTable`, etc.\n- Probe on pristine master: `ColumnNameToNumber(\"VGWQHXLSDVIKWV\")` returns `(0, nil)`.\n- This is a distinct root cause from GHSA-h69g-9hx6-f3v4 (row-index allocation): different mechanism (int64 wrap-around → negative index, not oversized allocation), different sink, different fix.\n\n### PoC\n\nA standalone program (public API only) was provided to the maintainer by email (`3-column-overflow`): it builds a workbook in memory whose `xl/worksheets/sheet1.xml` contains `<sheetData><row r=\"0\"><c r=\"VGWQHXLSDVIKWV1\" t=\"inlineStr\"><is><t>pwn</t></is></c></row></sheetData>` (<1 KB of attacker XML), calls `OpenReader`, then `GetCellValue(\"Sheet1\", \"A1\")` → `PANIC_REPRODUCED: runtime error: index out of range [-1]` on master `ecd99d761fe0` (2026-09-08). With the proposed patch the same program prints `NO_PANIC_BLOCKED`.\n\n### Impact\n\nA <1 KB crafted `.xlsx` crashes any service that opens a user-supplied spreadsheet and reads it — upload processing, mail-scanning pipelines, spreadsheet conversion endpoints. Remote, unauthenticated, no privileges.\n\n### Proposed fix\n\nBound the accumulated value inside the loop: check `col > MaxColumns` after each digit. Every digit is at least 1, so any name whose true value exceeds MaxColumns crosses the bound inside the loop, before the accumulation can wrap or overflow — this provably covers all cases, including wraps that would land back inside `[1, MaxColumns]`. A complete patch has been provided to the maintainer.","summary":"A Go library for reading and writing Excel files can compute an out-of-range cell coordinate from an overflowed integer without returning an error. The result is a panic, which crashes the program that is processing the spreadsheet.","severity":"high","cvss":7.5,"epss":0.00363,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/xuri/excelize","fixed":[],"affected":">= 1.1.0","ecosystem":"go"},{"name":"github.com/xuri/excelize/v2","fixed":["2.11.1-0.20260910071107-696050fbf14e"],"affected":"< 2.11.1-0.20260910071107-696050fbf14e","ecosystem":"go"},{"name":"excelize","fixed":[],"affected":">= 1.1.0, <= 1.4.1","ecosystem":"vendor"},{"name":"excelize","fixed":[],"affected":">= 2.0.0, <= 2.11.0","ecosystem":"vendor"},{"name":"github.com/xuri/excelize/v2","fixed":["2.11.1-0.20260910071107-696050fbf14e"],"affected":">= 2.0.0, < 2.11.1-0.20260910071107-696050fbf14e","ecosystem":"go"},{"name":"github.com/xuri/excelize","fixed":[],"affected":">= 1.1.0, <= 1.4.1","ecosystem":"go"}],"ecosystems":["go","vendor"],"tags":["cwe-129","cwe-190","excelize","go","package","spreadsheet-parsing"],"not_affected_if":["no-excelize-dependency","trusted-input-only"],"how_to_check":"- Check the version of `github.com/xuri/excelize/v2` in `go.mod`\n- Run `go list -m github.com/xuri/excelize/v2` in the project\n- Run `govulncheck ./...` to see whether the vulnerable code path is reachable","fix":"- `github.com/xuri/excelize/v2` `2.11.1-0.20260910071107-696050fbf14e`\n- `github.com/xuri/excelize` (v1 line): fixed version unknown","status":"open","published_at":"2026-10-07T19:17:33+00:00","first_seen_at":"2026-11-06T00:09:02+00:00","triaged_at":"2026-11-06T00:10:48+00:00","updated_at":"2026-11-06T00:19:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T00:10:48Z","model":"claude-haiku-5-5","output":{"fix":"- `github.com/xuri/excelize/v2` `2.11.1-0.20260910071107-696050fbf14e`\n- `github.com/xuri/excelize` (v1 line): fixed version unknown","reach":"unknown","title":"Excelize: integer overflow yields bad coordinate and panics Go programs","impact":"low","summary":"A Go library for reading and writing Excel files can compute an out-of-range cell coordinate from an overflowed integer without returning an error. The result is a panic, which crashes the program that is processing the spreadsheet.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","excelize","spreadsheet-parsing"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Crafted input crashes the process with a panic, causing denial of service","analyst_note":"Confirm whether the v1 github.com/xuri/excelize line has a fixed version; the source lists fixed as '?'. Check https://pkg.go.dev/vuln/GO-2026-6677 for the exact trigger.","how_to_check":"- Check the version of `github.com/xuri/excelize/v2` in `go.mod`\n- Run `go list -m github.com/xuri/excelize/v2` in the project\n- Run `govulncheck ./...` to see whether the vulnerable code path is reachable","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-excelize-dependency"],"who_is_affected":"Services that parse or write untrusted or user-supplied Excel files with excelize can be crashed by a crafted input that triggers the overflow. Programs that only generate spreadsheets from trusted data are unlikely to hit it. The sources do not give the exact input shape needed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000753,"input_tokens":4278,"output_tokens":650,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-08':430C '-09':429C '-1':192C,197C,209C,298C,424C '-107217':26A,37A '-129':53B '-190':55B '-2026':25A,33A,36A,248C '-237':105C '-26':110C '-350':228C '-443':175C '-54063':249C '-6677':34A '/xuri/excelize':40A,51A '/xuri/excelize/v2':43A,48A '0':22A,152C,162C,171C,187C,344C '1':164C,190C,405C,444C,494C,528C '14':137C '2':146C '2026':428C '2r75':31A '3':145C,391C '438':277C '9hx6':245C,356C 'a1':415C 'accumul':106C,478C,511C 'addtabl':335C 'alloc':236C,361C,372C 'also':292C 'api':322C,382C 'appli':128C 'around':286C,367C 'attack':326C,408C 'attacker-suppli':325C 'audit':253C 'back':526C 'base':109C,321C 'becom':191C 'biject':108C 'block':441C 'bound':124C,229C,476C,505C 'build':396C 'c':196C,296C 'c85p':29A 'call':176C,410C 'case':520C 'caus':15A,351C 'cell':78B 'cellnametocoordin':158C,267C 'check':125C,483C 'checkrow':183C 'checkrownum':225C 'checksheet':178C,260C 'checksheetr0':173C,262C 'closur':184C 'col':126C,151C,161C,186C,189C,484C 'colidx':188C 'colnum':297C 'column':114C,139C,256C,308C,314C,393C 'column-overflow':392C 'columnnametonumb':2A,103C,341C 'combin':304C 'commit':254C 'complet':531C 'comput':72B 'contain':403C 'convers':468C 'coordin':11A,79B,221C,275C 'cover':518C 'craft':446C 'crash':94B,448C 'cross':503C 'cve':24A,35A,247C 'cwe':52B,54B 'detail':214C 'detect':135C 'differ':362C,373C,375C 'digit':488C,490C 'distinct':349C 'domain':10A,274C 'e.g':147C,309C 'ecd99d761fe0':427C 'email':390C 'endpoint':469C 'enforc':224C 'err':165C,264C 'error':14A,87B,204C,419C 'etc':336C 'everi':489C 'exceed':501C 'excel':1A,56B,69B 'excelize':44A,45A 'excelize.go:342':227C 'excelize.go:356':276C 'excelize.go:405':180C 'excelize.go:417':174C 'excelize.go:424':198C 'f3v4':246C,357C 'feed':293C 'file':70B 'fix':240C,376C,475C 'gate':222C,291C 'getcellformula':330C 'getcellvalu':329C,413C 'getcolwidth':334C 'getmergecel':332C 'getsheetdimens':333C 'ghsa':28A,243C,354C 'ghsa-c85p-xxjj-2r75':27A 'ghsa-h69g-9hx6-f3v4':242C,353C 'github.com':39A,42A,47A,50A 'github.com/xuri/excelize':38A,49A 'github.com/xuri/excelize/v2':41A,46A 'go':32A,57B,63B 'guard':156C 'h69g':244C,355C 'host':212C 'ident':316C 'impact':442C 'in-domain':272C 'includ':238C,521C 'index':18A,205C,360C,369C,420C 'insid':480C,506C,527C 'int64':3A,118C,364C 'integ':83B 'kb':406C,445C 'kill':210C 'land':525C 'larg':307C 'lastrownum':261C 'least':493C 'letter':138C 'lib.go:220':104C 'librari':64B 'loop':131C,482C,508C 'mail':464C 'mail-scan':463C 'maintain':388C,538C 'make':233C 'master':340C,426C 'maxcolumn':127C,485C,502C,529C 'mechan':363C 'memori':400C 'name':115C,140C,497C 'negat':16A,368C 'nil':13A,166C,265C,345C 'normal':168C 'open':452C 'openread':411C 'out-of-domain':7A 'out-of-rang':74B 'overflow':4A,82B,134C,313C,394C,515C 'overs':371C 'packag':58B 'panic':19A,92B,202C,315C,416C,440C 'pars':61B 'pass':154C 'patch':434C,532C 'pipelin':466C 'poc':377C 'present':250C 'print':438C 'pristin':339C 'privileg':473C 'probe':337C 'process':99B,213C,462C 'program':96B,380C,437C 'proof':269C 'propos':433C,474C 'provabl':517C 'provid':385C,535C 'public':381C 'pwn':404C 'r':21A,170C,230C 'rais':199C 'rang':77B,208C,423C 'reachabl':317C 'read':66B,459C 'remot':470C 'reproduc':417C 'result':89B 'return':85B,160C,343C 'root':350C 'row':23A,163C,172C,216C,235C,303C,359C 'row-index':358C 'rowidx':195C,295C 'rows.go:969':301C 'run':181C 'runtim':203C,418C 'scan':465C 'servic':450C 'setcellvalu':331C 'sheet1':414C 'sheetdata.row':194C 'side':217C,257C 'sink':374C 'slice':17A 'spreadsheet':60B,101B,457C,467C 'spreadsheet-pars':59B 'standalon':379C 'summari':102C 'suppli':327C,456C 'treat':263C 'true':142C,499C 'unauthent':471C 'unrecov':201C 'unsound':280C,290C 'upload':461C 'upper':123C 'upper-bound':122C 'user':455C 'user-suppli':454C 'valid':306C 'valu':111C,143C,479C,500C 'vgwqhxlsdvikwv':148C,342C 'vgwqhxlsdvikwv1':159C 'whose':141C,401C,498C 'without':84B 'workbook':398C 'worksheet':328C 'worksheetread':320C 'would':524C 'wrap':149C,285C,366C,513C,522C 'wrap-around':284C,365C 'write':68B 'ws.sheetdata.row':294C 'xfd1':310C 'xl/worksheets/sheet1.xml':402C 'xlsx':447C 'xlsxrow':234C 'xlsxworksheet.checkrow':300C 'xml':409C 'xxjj':30A 'yield':5A","nicknames":[],"mitigations":[],"who_affected":"Services that parse or write untrusted or user-supplied Excel files with excelize can be crashed by a crafted input that triggers the overflow. Programs that only generate spreadsheets from trusted data are unlikely to hit it. The sources do not give the exact input shape needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["excelize","githubcomxuriexcelize","githubcomxuriexcelizev2"],"ptokens":["com","excelize","github","v2","xuri"],"labels":["cwe129","cwe190","excelize","go","high","package","spreadsheetparsing","vendor"],"campaign_type":null,"first_public_at":"2026-09-10T07:10:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6677","url":"https://pkg.go.dev/vuln/GO-2026-6677","severity":null,"published_at":"2026-11-05T22:53:46+00:00","modified_at":"2026-11-05T22:53:46+00:00","first_seen_at":"2026-11-06T00:09:02+00:00","fetched_at":"2026-11-06T00:09:02+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107217","severity":null,"published_at":"2026-10-07T19:17:33+00:00","modified_at":"2026-10-13T14:23:36+00:00","first_seen_at":"2026-11-06T00:19:01+00:00","fetched_at":"2026-11-06T00:19:01+00:00","note":null},{"source":"ghsa","external_id":"GHSA-c85p-xxjj-2r75","url":"https://github.com/advisories/GHSA-c85p-xxjj-2r75","severity":"high","published_at":"2026-10-07T20:23:31+00:00","modified_at":"2026-10-07T20:23:32+00:00","first_seen_at":"2026-11-06T00:19:08+00:00","fetched_at":"2026-11-06T00:19:08+00:00","note":null}],"documents":[{"id":81833,"url":"https://github.com/qax-os/excelize/commit/696050fbf14e74e96a58eef2b16aaf72f381a6a8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81834,"url":"https://github.com/qax-os/excelize/pull/2394","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81835,"url":"https://github.com/qax-os/excelize/security/advisories/GHSA-c85p-xxjj-2r75","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-10T07:10:04+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":81910,"url":"https://api.github.com/repos/qax-os/excelize/security-advisories/GHSA-c85p-xxjj-2r75","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"}],"exploit_sources":[{"type":"epss","score":0.00363,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107217"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}