Vulnerability Details CVE-2026-107225
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 15.0%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-107225
-
cpe:2.3:a:excelize:excelize:2.10.0
-
cpe:2.3:a:excelize:excelize:2.10.1
-
cpe:2.3:a:excelize:excelize:2.11.0
-
cpe:2.3:a:excelize:excelize:2.8.0
-
cpe:2.3:a:excelize:excelize:2.8.1
-
cpe:2.3:a:excelize:excelize:2.9.0
-
cpe:2.3:a:excelize:excelize:2.9.1