CVE-2026-54063
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The Excelize Go library before version 2.11.0 has a vulnerability in the checkSheet() function that uses an attacker-controlled XML attribute <row r="N"> without validation. A crafted XLSX file can cause massive memory allocation (up to 16 GB) or a panic due to out-of-bounds indexing, leading to denial of service (DoS).
Risk Assessment
The organization is exposed to DoS attacks that can crash services processing XLSX files from unauthenticated users, causing application downtime and potential financial losses.
Recommendation
Immediately update the excelize library to version 2.11.0 or later. As a workaround, restrict XLSX file opening functionality to trusted sources only.
Other vulnerabilities in excelize
See all- CVE-2026-59162High
The Excelize Go library before version 2.11.0 has a vulnerability due to missing lower-bound validation when parsing shared-string cell values. A specially crafted XLSX file with a value of -1 can cause an out-of-bounds slice access and panic when read via GetCellValue or GetRows.
- CVE-2026-59161High
The Excelize Go library before version 2.11.0 does not enforce the TotalRows limit on the row r attribute during streaming worksheet reading. An attacker can supply a small XLSX file with a row number above 1048576, causing empty rows to be appended and excessive memory and CPU consumption.
Original NVD description (English source)
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled <row r="N"> XML attribute value directly as the length argument to make([]xlsxRow, row) without validating it against the Excel row limit (TotalRows = 1,048,576). A specially crafted XLSX file can trigger two denial-of-service variants: (A) an out-of-memory process kill when r=2147483647 forces a ~16 GB allocation attempt, and (B) a runtime panic via out-of-bounds slice indexing when r=-1. Any service that opens attacker-supplied XLSX files and calls GetCellValue is affected. No authentication is required. This issue is fixed in version 2.11.0.