{"id":"CVE-2026-107215","title":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets","summary":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector c…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-789"],"vendor":"excelize","product":"excelize","affected":["excelize >= 2.3.1, <= 2.11.0"],"patched":["github.com/xuri/excelize/v2 2.11.1-0.20260912113515-5f636f9dcde5"],"published":"2026-10-07","updated":"2026-10-13","sourceUpdated":"2026-10-13T14:23:50.540","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107215","references":[{"url":"https://github.com/qax-os/excelize/commit/5f636f9dcde55911f14290060b017f0cc88cd694","label":"security-advisories@github.com"},{"url":"https://github.com/qax-os/excelize/pull/2396","label":"security-advisories@github.com"},{"url":"https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f","label":"security-advisories@github.com"},{"url":"https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107215"},{"url":"https://github.com/advisories/GHSA-x2q3-8cjh-766f"},{"url":"https://github.com/qax-os/excelize"}],"tags":["nvd","cve.org","ghsa","go","osv","exploit-available"],"epss":0.0024,"epssPercentile":0.15073,"aliases":["GHSA-x2q3-8cjh-766f","GO-2026-6689"],"ecosystem":"go","ingestedAt":"2026-10-07T18:42:20.891Z","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-10T02:38:08.709822Z"},"slug":"CVE-2026-107215","body":"## Overview\n\nExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review.\n\n## Affected\n\n- `excelize >= 2.3.1, <= 2.11.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-107215)\n\nAffected packages:\n\n- `github.com/xuri/excelize/v2 >= 2.3.1, < 2.11.1-0.20260912113515-5f636f9dcde5`\n\nPatched in:\n\n- `github.com/xuri/excelize/v2 2.11.1-0.20260912113515-5f636f9dcde5`\n\nSource: https://github.com/advisories/GHSA-x2q3-8cjh-766f","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":220683,"id":"CVE-2026-107215","ts":1792026562907,"field":"exploit_available","old":"false","new":"true"}]}