Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M

CVE-2026-107220Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

Medium 6.5

In plain English

A medium-severity out-of-bounds read in excelize from qax-os. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 81.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/xuri/excelize/v2	2.11.1-0.20260820023833-99903a3240e5	GHSA-g27h-8qhm-6pff
Go	github.com/xuri/excelize/v2	2.11.1-0.20260820023833-99903a3240e5	GO-2026-6680

Affected products (as reported)

Vendor	Product	Versions
qax-os	excelize	>= 2.7.1, <= 2.11.0

Weakness: CWE-125, CWE-129 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff x_refsource_CONFIRM
https://github.com/qax-os/excelize/pull/2379 x_refsource_MISC
https://github.com/qax-os/excelize/commit/99903a3240e58a47ff28fb8e05a03bd9d496ec24 x_refsource_MISC