CVE-2026-107217 · GHSA-c85p-xxjj-2r75
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
- Risk score
- 65/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column …
- Affected
- github.com/xuri/excelize/v2 (go) >= 2.0.0, < 2.11.1-0.20260910071107-696050fbf14e; github.com/xuri/excelize (go) >= 1.1.0, <= 1.4.1
- Fix
- Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260910071107-696050fbf14e or later.
- Exploitation
- Public proof of concept
Story map
At a glance
github.com/xuri/excelize/v2: Amber, patch this week. Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxCo…
The flaws
- CVE-2026-107217: Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows (CVSS 7.5 · EPSS 0%)
- CVE-2026-107223: Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process (CVSS 7.5 · EPSS 0%)
- CVE-2026-107212: Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days (CVSS 7.5 · EPSS 0%)
- CVE-2026-107219: Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile (CVSS 7.5 · EPSS 0%)
The fix
Fix: Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260807015645-a54c578af309 or later.
Who is exposed: github.com/xuri/excelize/v2 (go) >= 2.1.0, < 2.11.1-0.20260807015645-a54c578af309
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-129 (CWE-129). 23 other warnings in 30 days
- Same product: Earlier github.com/xuri/excelize/v2 warnings. 11 in the last 90 days
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/xuri/excelize/v2 | go | >= 2.0.0, < 2.11.1-0.20260910071107-696050fbf14e | 2.11.1-0.20260910071107-696050fbf14e |
| github.com/xuri/excelize | go | >= 1.1.0, <= 1.4.1 | No fix yet |
References
Original description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column name to wrap to zero with no error. ColumnNameToNumber accepts the overflowing name VGWQHXLSDVIKWV, after which checkSheetR0 and xlsxWorksheet.checkRow use the wrapped column value as an index. When a crafted worksheet uses an overflowing column name in a row normalized by checkSheetR0 or checkRow, the wrapped zero column becomes a negative slice index during worksheet normalization, allowing an attacker to panic and terminate the calling process. No fixed version is available as of this review.
Last activity 7 Oct 2026. Patch Forecast updates every hour.