CVE-2026-107214 · GHSA-2j4c-ffch-9f23

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

Risk score: 63/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.2%
Published: 7 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values. Decrypt passes attack…
Affected: github.com/xuri/excelize/v2 (go) >= 2.3.1, < 2.11.1-0.20260915055537-22f76f9acb94
Fix: Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260915055537-22f76f9acb94 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/xuri/excelize/v2: Amber, patch this week. Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxCo…

The flaws

CVE-2026-107214: Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks (CVSS 7.5 · EPSS 0%)
CVE-2026-107223: Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process (CVSS 7.5 · EPSS 0%)
CVE-2026-107212: Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days (CVSS 7.5 · EPSS 0%)
CVE-2026-107217: Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows (CVSS 7.5 · EPSS 0%)

The fix

Fix: Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260807015645-a54c578af309 or later.

Who is exposed: github.com/xuri/excelize/v2 (go) >= 2.1.0, < 2.11.1-0.20260807015645-a54c578af309

Where it stands

Public proof of concept

Connects to

Same weakness: CWE-248 (CWE-248). 63 other warnings in 30 days
Same product: Earlier github.com/xuri/excelize/v2 warnings. 11 in the last 90 days

Why it is Amber

CVSS 7.5 high
Public exploit or proof of concept referenced
Remotely exploitable without logging in
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/xuri/excelize/v2	go	>= 2.3.1, < 2.11.1-0.20260915055537-22f76f9acb94	2.11.1-0.20260915055537-22f76f9acb94

References

Original description

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values. Decrypt passes attacker-controlled EncryptionInfo and EncryptedPackage data into standardDecrypt or agileDecrypt before validating the structures used by those routines. When a malformed OLE compound file with a version-valid EncryptionInfo stream is opened or passed to Decrypt, nine malformed-input classes reach unrecovered Go runtime panics instead of the documented error path, allowing an attacker to terminate the calling process. No fixed version is available as of this review.

Last activity 7 Oct 2026. Patch Forecast updates every hour.