Vulnerability Details CVE-2026-107219
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes the unbounded spinCount to convertPasswdToKey before password verification. When a crafted OLE encrypted-workbook header supplies an excessive spinCount and the file is opened, the key-derivation loop performs unbounded attacker-selected work and cannot be cancelled, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 25.0%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-107219
-
cpe:2.3:a:excelize:excelize:2.10.0
-
cpe:2.3:a:excelize:excelize:2.10.1
-
cpe:2.3:a:excelize:excelize:2.11.0
-
cpe:2.3:a:excelize:excelize:2.3.1
-
cpe:2.3:a:excelize:excelize:2.3.2
-
cpe:2.3:a:excelize:excelize:2.4.0
-
cpe:2.3:a:excelize:excelize:2.4.1
-
cpe:2.3:a:excelize:excelize:2.5.0
-
cpe:2.3:a:excelize:excelize:2.6.0
-
cpe:2.3:a:excelize:excelize:2.6.1
-
cpe:2.3:a:excelize:excelize:2.7.0
-
cpe:2.3:a:excelize:excelize:2.7.1
-
cpe:2.3:a:excelize:excelize:2.8.0
-
cpe:2.3:a:excelize:excelize:2.8.1
-
cpe:2.3:a:excelize:excelize:2.9.0
-
cpe:2.3:a:excelize:excelize:2.9.1