CVE-2026-107218
Received Received - Intake

RIGHT Function UTF-16 Code-Unit Mismatch in Excelize

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-08
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-107218
EUVD
EUVD-2026-94548

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qax-os excelize >= 2.10.1, <= 2.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Excelize Go library's RIGHT function between versions 2.10.1 and 2.11.0. It occurs when processing supplementary-plane text (characters outside the Basic Multilingual Plane) where the function validates length using UTF-16 code-unit counts but slices the text using Unicode code-point counts. This mismatch can create a negative index, causing a panic during formula evaluation.

Detection Guidance

This vulnerability is specific to the Excelize Go library and affects formula evaluation in Excel files. Detection requires checking if your application uses Excelize versions 2.10.1 to 2.11.0 and processes RIGHT() functions with supplementary-plane Unicode characters. No direct network detection commands exist; inspect code for Excelize usage and version.

Impact Analysis

An attacker could exploit this to crash applications using the Excelize library when processing specific Excel formulas containing supplementary-plane characters. This leads to denial-of-service conditions by causing unexpected panics in the application.

Compliance Impact

This vulnerability primarily causes application crashes (denial of service) due to panics during formula evaluation. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, service disruptions from crashes could indirectly affect compliance by impairing data processing capabilities.

Mitigation Strategies
  • Upgrade Excelize to version 2.11.1 or later if using RIGHT(), LEFT(), RIGHTB(), or LEFTB() functions.
  • Avoid processing untrusted Excel files with these functions until upgraded.
  • Implement panic recovery in code calling Excelize functions to handle potential crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107218. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart