CVE-2026-107222
Received Received - Intake

Heap Out-of-Bounds Read in Excelize Conditional Format Parsing

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-08
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-107222
EUVD
EUVD-2026-94552

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qax-os excelize >= 2.7.0, <= 2.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Excelize, a Go library for Excel file manipulation. It allows out-of-range memory access or nil dereferencing when processing malformed conditional formatting rules in Excel files. Attackers can craft files that trigger crashes in applications using vulnerable versions.

Detection Guidance

This vulnerability involves malformed conditional format rules in Excel files processed by Excelize. Detection requires inspecting Excel files for crafted worksheets with missing child elements in conditional format rules. No direct network or system commands are provided in the context.

Impact Analysis

If you use an affected version of Excelize, opening a specially crafted Excel file could crash your application. This may lead to denial-of-service conditions or data loss if the application doesn't handle the crash gracefully.

Compliance Impact

This vulnerability primarily causes process crashes due to malformed Excel files, which could lead to denial-of-service conditions. It does not directly affect data confidentiality or integrity but may impact system availability. Compliance standards like GDPR and HIPAA focus on data protection and availability; while this issue does not expose data, repeated crashes could disrupt services handling sensitive information, potentially affecting compliance with availability requirements.

Mitigation Strategies

Avoid processing untrusted Excel files with Excelize versions 2.7.0 to 2.11.0. Update to a patched version if available. If no patch exists, disable conditional format extraction or use alternative libraries until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107222. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart