CVE-2026-107224 — Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets.
Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.
CVSS v3.1 base metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HMedium severity
Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.
AV
Network
Attack Vector
AC
Low
Attack Complexity
PR
None
Privileges Required
UI
Required
User Interaction
S
Unchanged
Scope
C
None
Confidentiality
I
None
Integrity
A
High
Availability
Affected
- Vendor
- Go
- Product
- github.com/xuri/excelize/v2
Versions
- pkg:golang/github.com/xuri/excelize/v2 >= 2.1.0, < 2.11.1-0.20260805032953-db93f8d89de7
Stated as the source expressed them.
References
- advisory[email protected]https://github.com/qax-os/excelize/commit/db93f8d89de71589069a54d1b998af02e3c5f7cd
- advisory[email protected]https://github.com/qax-os/excelize/pull/2369
- advisory134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw
- advisoryOSV GHSA-fw94-4wwp-w8pwhttps://osv.dev/vulnerability/GHSA-fw94-4wwp-w8pw
- vendorOSV packagehttps://github.com/qax-os/excelize
Related threats
same CWE or vendorCVE-2026-106432 — The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation.
CVE-2026-106432 · 3h ago
CVE-2026-107386 — amqp091-go is a Go AMQP 0.9.1 client.
CVE-2026-107386 · 4h ago
CVE-2026-107324 — An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a ma…
CVE-2026-107324 · 4h ago
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor
OSV · 5h ago
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection
OSV · 5h ago
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion
OSV · 5h ago