CVE-2026-59162
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The Excelize Go library before version 2.11.0 has a vulnerability due to missing lower-bound validation when parsing shared-string cell values. A specially crafted XLSX file with a value of -1 can cause an out-of-bounds slice access and panic when read via GetCellValue or GetRows.
Risk Assessment
An attacker can supply a malicious XLSX file that, when opened by an application using the vulnerable library version, causes a panic and crashes the service, leading to a Denial of Service (DoS).
Recommendation
Immediately update the Excelize library to version 2.11.0 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Excelize
See all- CVE-2026-59161High
The Excelize Go library before version 2.11.0 does not enforce the TotalRows limit on the row r attribute during streaming worksheet reading. An attacker can supply a small XLSX file with a row number above 1048576, causing empty rows to be appended and excessive memory and CPU consumption.
- CVE-2026-54063High
The Excelize Go library before version 2.11.0 has a vulnerability in the checkSheet() function that uses an attacker-controlled XML attribute <row r="N"> without validation. A crafted XLSX file can cause massive memory allocation (up to 16 GB) or a panic due to out-of-bounds indexing, leading to denial of service (DoS).
Original NVD description (English source)
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with -1 to trigger sharedStrings[-1] and panic when read through GetCellValue or GetRows. This issue is fixed in version 2.11.0.