CVE-2026-107220 — Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets.
Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.
CVSS v3.1 base metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HMedium severity
Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.
AV
Network
Attack Vector
AC
Low
Attack Complexity
PR
None
Privileges Required
UI
Required
User Interaction
S
Unchanged
Scope
C
None
Confidentiality
I
None
Integrity
A
High
Availability
Affected
- Vendor
- Go
- Product
- github.com/xuri/excelize/v2
Versions
- pkg:golang/github.com/xuri/excelize/v2 >= 2.7.1, < 2.11.1-0.20260820023833-99903a3240e5
Stated as the source expressed them.
References
- advisory[email protected]https://github.com/qax-os/excelize/commit/99903a3240e58a47ff28fb8e05a03bd9d496ec24
- advisory[email protected]https://github.com/qax-os/excelize/pull/2379
- advisory[email protected]https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff
- advisoryOSV GHSA-g27h-8qhm-6pffhttps://osv.dev/vulnerability/GHSA-g27h-8qhm-6pff
- vendorOSV packagehttps://github.com/qax-os/excelize
Related threats
same CWE or vendorCVE-2026-107738 — SumatraPDF is a multi-format reader for Windows.
CVE-2026-107738 · 3h ago
CVE-2026-107737 — SumatraPDF is a multi-format reader for Windows.
CVE-2026-107737 · 3h ago
CVE-2026-107731 — SumatraPDF is a multi-format reader for Windows.
CVE-2026-107731 · 3h ago
CVE-2026-107729 — SumatraPDF is a multi-format reader for Windows.
CVE-2026-107729 · 3h ago
CVE-2026-12091 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a heap-b…
CVE-2026-12091 · 5h ago
CVE-2026-106435 — The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-…
CVE-2026-106435 · 5h ago