Vulnpedia
← Search CVEs

CVE-2026-107219

HIGH 7.5

Published 2026-10-07 · Last modified 2026-10-07

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes the unbounded spinCount to convertPasswdToKey before password verification. When a crafted OLE encrypted-workbook header supplies an excessive spinCount and the file is opened, the key-derivation loop performs unbounded attacker-selected work and cannot be cancelled, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 30th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Qax Os Excelize

Products Excelize

Weakness (CWE)

  • CWE-400: : Uncontrolled Resource Consumption

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • github.com/xuri/excelize/v2 Go

    pkg:golang/github.com/xuri/excelize/v2

    SEMVER range
    • Introduced version (included): 2.3.1
    • Fixed boundary (excluded): 2.11.1-0.20260906004932-2badfcd5841d
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-jrfj-fhj2-jjvm/GHSA-jrfj-fhj2-jjvm.json"
  }
}
    GitHub Advisory Database · GHSA-jrfj-fhj2-jjvm · Updated 2026-10-07T20:30:05.832809888Z

Known Affected Software Configurations

VendorProductVersion range
ExcelizeExcelize≥ 2.3.1 and ≤ 2.11.0

All CVSS metrics

  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Exploit-tagged references (not proof of a PoC)

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS