CVE-2026-107221
Received Received - Intake

Out-of-Bounds Read in Excelize Go Library

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and checkRow, where targetList is too short for an earlier out-of-order cell. When a crafted row places a higher-column cell before a lower-column final cell and a non-streaming worksheet API reads the sheet, the earlier cell's column index exceeds the slice length derived from the final cell, allowing an attacker to cause an unrecovered panic and terminate the process. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-08
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-107221
EUVD
EUVD-2026-94551

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qax-os excelize >= 2.0.0, <= 2.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Excelize Go library for Excel files. It occurs when processing rows where cells are not in ascending column order. The checkRow function sizes a slice based on the last cell's column but then tries to write an earlier cell with a higher column index, causing an out-of-bounds panic and crashing the program.

Detection Guidance

To detect this vulnerability, inspect Go applications using the Excelize library versions 2.0.0 to 2.11.0. Check for crashes or panics when processing Excel files with cells in non-ascending column order. Review logs for 'index out of range' errors during worksheet reads.

Impact Analysis

An attacker can create a malicious Excel file with cells in descending column order. Opening this file and using non-streaming APIs like GetCellValue triggers a panic, crashing the application processing the file. This leads to denial of service as the process terminates unexpectedly.

Compliance Impact

This vulnerability primarily impacts system availability by causing crashes when processing maliciously crafted Excel files. It does not directly affect data confidentiality or integrity. For compliance standards like GDPR or HIPAA, the main concern would be potential service disruption during file processing, which could impact operations handling sensitive data. However, the vulnerability does not lead to data exposure or unauthorized access.

Mitigation Strategies

Upgrade the Excelize library to version 2.11.1 or later if available. If upgrading is not possible, avoid processing untrusted Excel files with the library or implement bounds checking before cell value assignments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107221. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart