CVEvulnerability

CVE-2026-107225

6.5 MEDIUM Published 2026-10-07 Modified 2026-10-13 Official page ↗
Status
Analyzed
Published
2026-10-07
Last modified
2026-10-13
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-129, CWE-20

Description

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.

Affected configurations

• excelize excelize (>= 2.8.0 <= 2.11.0)

Related

Weakness · CWE (2)

  • CWE-129 Improper Validation of Array Index weakness
  • CWE-20 Improper Input Validation weakness

References