CVE-2026-107213Medium· 5.5▾ SunlitExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element ex…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
8.7 → 5.5
high → medium
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. File.GetSlicers reads ws.Drawing.RID after seeing a worksheet extLst element even when the independently optional worksheet drawing element is absent. When a crafted worksheet contains an extLst element without a drawing element and the application calls GetSlicers, the nil ws.Drawing pointer is dereferenced while resolving the drawing relationship, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.
excelize >= 2.9.0, <= 2.11.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/xuri/excelize/v2 >= 2.9.0, < 2.11.1-0.20260929015830-8ffeb07ec9a3Patched in:
github.com/xuri/excelize/v2 2.11.1-0.20260929015830-8ffeb07ec9a3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107222Medium· 6.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2026-107211Medium· 5.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2026-107223High· 7.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2026-107224Medium· 6.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2026-107225Medium· 6.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2026-107218Medium· 5.3Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets