CVE-2026-107224
Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.
How to fix
- github.com/xuri/excelize/v22.11.1-0.20260805032953-db93f8d89de7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| excelize excelize | 2.1.0 ≤ v ≤ 2.11.0 | — |
| github.com/xuri/excelize/v2Go | 2.1.0 ≤ v < 2.11.1-0.20260805032953-db93f8d89de7 | 2.11.1-0.20260805032953-db93f8d89de7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.