CVE-2026-59161 | BDVDB-2026-347017 Detail

Description#

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-10Record published in the CVE List.
2. Version 22026-07-14Most recent update recorded in the CVE List.