CVE-2026-107220
Received Received - Intake

Excelize Go Library MergeCell Ref Panic via Empty Slice

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-08
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-107220
EUVD
EUVD-2026-94550

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qax-os excelize >= 2.7.1, <= 2.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service vulnerability in the Excelize Go library for Excel files. It occurs when processing a worksheet with an empty mergeCell reference. The library fails to validate the length of a slice before accessing it, causing a panic when reading cells.

Detection Guidance

Detecting this vulnerability requires checking if your system uses the vulnerable Excelize library versions (2.7.1 to 2.11.0). Inspect your Go module dependencies for excelize and verify the version. No direct network detection commands are provided in the context.

Impact Analysis

If you use the affected Excelize versions (2.7.1 to 2.11.0) to read Excel files containing malformed mergeCell references, your application may crash due to a panic. This could disrupt services relying on Excel processing.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a denial-of-service issue causing application crashes rather than a data breach or privacy violation. However, if an application crashes while processing Excel files containing sensitive data, it could disrupt access to that data, potentially impacting availability requirements under these regulations.

Mitigation Strategies

Immediate mitigation involves upgrading to a patched version if available or removing the vulnerable library. Since no fixed version is available as of the review, avoid processing Excel files with empty mergeCell references until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107220. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart