CVE-2026-107220
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Description
AI Translation Available
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.
125
Out-of-bounds Read
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Availability
Other
Potential Impacts:
Read Memory
Bypass Protection Mechanism
Dos: Crash, Exit, Or Restart
Varies By Context
Applicable Platforms
Languages:
Memory-Unsafe, C, C++
Technologies:
ICS/OT
129
Improper Validation of Array Index
DraftCommon Consequences
Security Scopes Affected:
Integrity
Availability
Confidentiality
Potential Impacts:
Dos: Crash, Exit, Or Restart
Modify Memory
Read Memory
Execute Unauthorized Code Or Commands
Applicable Platforms
Languages:
C, C++, Not Language-Specific
https://github.com/qax-os/excelize/commit/99903a3240e58a47ff28fb8e05a03bd9d496e…
https://github.com/qax-os/excelize/pull/2379
https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff