What’s Vulnerable › Vulnerabilities

CVE-2026-107224: Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-10-07 · updated 2026-10-13
• Weakness: CWE-190

Description

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.

Affected products

• qax-os excelize: from 2.1.0 through 2.11.0

References

• https://github.com/qax-os/excelize/commit/db93f8d89de71589069a54d1b998af02e3c5f7cd
• https://github.com/qax-os/excelize/pull/2369
• https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw
• https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw

Get alerted when CVE-2026-107224 or the next vulnerability affects your stack