--- id: "CVE-2026-107217" page: "https://infrastack.ai/live/CVE-2026-107217" kind: "vulnerability" aliases: ["CVE-2026-107217", "GHSA-c85p-xxjj-2r75", "GO-2026-6677"] title: "Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r=\"0\" rows" severity: "high" cvss: 7.5 epss: 0.00363 exploited: false status: "open" category: "package" products: [{"name": "github.com/xuri/excelize", "fixed": [], "affected": ">= 1.1.0", "ecosystem": "go"}, {"name": "github.com/xuri/excelize/v2", "fixed": ["2.11.1-0.20260910071107-696050fbf14e"], "affected": "< 2.11.1-0.20260910071107-696050fbf14e", "ecosystem": "go"}, {"name": "excelize", "fixed": [], "affected": ">= 1.1.0, <= 1.4.1", "ecosystem": "vendor"}, {"name": "excelize", "fixed": [], "affected": ">= 2.0.0, <= 2.11.0", "ecosystem": "vendor"}, {"name": "github.com/xuri/excelize/v2", "fixed": ["2.11.1-0.20260910071107-696050fbf14e"], "affected": ">= 2.0.0, < 2.11.1-0.20260910071107-696050fbf14e", "ecosystem": "go"}, {"name": "github.com/xuri/excelize", "fixed": [], "affected": ">= 1.1.0, <= 1.4.1", "ecosystem": "go"}] ecosystems: ["go", "vendor"] tags: ["cwe-129", "cwe-190", "excelize", "go", "package", "spreadsheet-parsing"] not_affected_if: ["no-excelize-dependency", "trusted-input-only"] published_at: "2026-10-07T19:17:33+00:00" first_seen_at: "2026-11-06T00:09:02+00:00" updated_at: "2026-11-06T00:19:08+00:00" sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6677", "first_seen_at": "2026-11-06T00:09:02+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107217", "first_seen_at": "2026-11-06T00:19:01+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-c85p-xxjj-2r75", "first_seen_at": "2026-11-06T00:19:08+00:00"}] exploit_sources: [{"type": "epss", "score": 0.00363, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107217"}] --- # Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows Link for people: https://infrastack.ai/live/CVE-2026-107217 (this .md is for agents) A Go library for reading and writing Excel files can compute an out-of-range cell coordinate from an overflowed integer without returning an error. The result is a panic, which crashes the program that is processing the spreadsheet. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - go:github.com/xuri/excelize affected >= 1.1.0 fixed no fixed version listed - go:github.com/xuri/excelize/v2 affected < 2.11.1-0.20260910071107-696050fbf14e fixed 2.11.1-0.20260910071107-696050fbf14e - vendor:excelize affected >= 1.1.0, <= 1.4.1 fixed no fixed version listed - vendor:excelize affected >= 2.0.0, <= 2.11.0 fixed no fixed version listed - go:github.com/xuri/excelize/v2 affected >= 2.0.0, < 2.11.1-0.20260910071107-696050fbf14e fixed 2.11.1-0.20260910071107-696050fbf14e - go:github.com/xuri/excelize affected >= 1.1.0, <= 1.4.1 fixed no fixed version listed ## How to check - Check the version of `github.com/xuri/excelize/v2` in `go.mod` - Run `go list -m github.com/xuri/excelize/v2` in the project - Run `govulncheck ./...` to see whether the vulnerable code path is reachable ## Fix - `github.com/xuri/excelize/v2` `2.11.1-0.20260910071107-696050fbf14e` - `github.com/xuri/excelize` (v1 line): fixed version unknown ## Timeline - 2026-11-06T00:09:02+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6677 - 2026-11-06T00:19:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107217 - 2026-11-06T00:19:08+00:00 ghsa https://github.com/advisories/GHSA-c85p-xxjj-2r75 ## Documents - [advisory] Vendor advisory: github.com https://github.com/qax-os/excelize/security/advisories/GHSA-c85p-xxjj-2r75 - [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/qax-os/excelize/security-advisories/GHSA-c85p-xxjj-2r75 - [fix] Patch: github.com https://github.com/qax-os/excelize/commit/696050fbf14e74e96a58eef2b16aaf72f381a6a8 - [fix] Patch: github.com https://github.com/qax-os/excelize/pull/2394 ## From the sources ### Summary `ColumnNameToNumber` (lib.go:220-237) accumulates the bijective base-26 value of a column name in an int64 with only an upper-bound check (`col > MaxColumns`) applied after the loop and no overflow detection. A 14-letter column name whose true value is 3·2⁶⁴ — e.g. **`VGWQHXLSDVIKWV`** — wraps to `col = 0` and passes the guard, so `CellNameToCoordinates("VGWQHXLSDVIKWV1")` returns `(col=0, row=1, err=nil)`. When normalizing a `r="0"` row, `checkSheetR0` (excelize.go:417-443, called from `checkSheet` at excelize.go:405) runs its `checkRow` closure with `col = 0`: `colIdx := col - 1` becomes **-1**, and `sheetData.Row[rowIdx].C[-1]` (excelize.go:424) raises an unrecovered `panic: runtime error: index out of range [-1]`, killing the host process. ### Details - The row side of the same coordinate gate is enforced (`checkRowNum` at excelize.go:342-350 bounds `r` before the `make([]xlsxRow, row)` allocation; this includes the fix for GHSA-h69g-9hx6-f3v4 / CVE-2026-54063, present in the audited commit). The **column** side is not: `checkSheet`/`lastRowNum`/`checkSheetR0` treat `err == nil` from `CellNameToCoordinates` as proof of an in-domain coordinate (excelize.go:356, :438), which is unsound because of the wrap-around above. - The same unsound gate also feeds `ws.SheetData.Row[rowIdx].C[colNum-1]` in `xlsxWorksheet.checkRow` (rows.go:969): a row combining a valid large column (e.g. `XFD1`) with an overflowed column panics identically. - Reachable from any `workSheetReader`-based API on an attacker-supplied worksheet: `GetCellValue`, `GetCellFormula`, `SetCellValue`, `GetMergeCells`, `GetSheetDimension`, `GetColWidth`, `AddTable`, etc. - Probe on pristine master: `ColumnNameToNumber("VGWQHXLSDVIKWV")` returns `(0, nil)`. - This is a distinct root cause from GHSA-h69g-9hx6-f3v4 (row-index allocation): different mechanism (int64 wrap-around → negative index, not oversized allocation), different sink, different fix. ### PoC A standalone program (public API only) was provided to the maintainer by email (`3-column-overflow`): it builds a workbook in memory whose `xl/worksheets/sheet1.xml` contains `pwn` (<1 KB of attacker XML), calls `OpenReader`, then `GetCellValue("Sheet1", "A1")` → `PANIC_REPRODUCED: runtime error: index out of range [-1]` on master `ecd99d761fe0` (2026-09-08). With the proposed patch the same program prints `NO_PANIC_BLOCKED`. ### Impact A <1 KB crafted `.xlsx` crashes any service that opens a user-supplied spreadsheet and reads it — upload processing, mail-scanning pipelines, spreadsheet conversion endpoints. Remote, unauthenticated, no privileges. ### Proposed fix Bound the accumulated value inside the loop: check `col > MaxColumns` after each digit. Every digit is at least 1, so any name whose true value exceeds MaxColumns crosses the bound inside the loop, before the accumulation can wrap or overflow — this provably covers all cases, including wraps that would land back inside `[1, MaxColumns]`. A complete patch has been provided to the maintainer. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_