CVE-2026-107225 | BDVDB-2026-384372 Detail

Description#

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-07Record published in the CVE List.
2. Version 22026-10-10Most recent update recorded in the CVE List.