CVE-2026-107220— Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
Quick assessment
Affected
qax-os excelize
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Excelize 是一个用于读取和写入 Microsoft Excel 电子表格的 Go 语言库。在版本 2.7.1 到 2.11.0 中， 函数在处理空的 引用时，会将缓存的矩形对象留空，随后在未进行长度检查的情况下将该空切片传递给 函数。当调用 时，该函数会进入 ，并由 的 ref 属性生成一个空矩形，再传入 。如果构造的电子表格包含空的 引用，并且使用非流式（non-streaming）单元格 API 读取该表格， 会在一个空切片上索引四个位置，从而导致攻击者在首次受影响的单元格操作中引发 panic 错误。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107220
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
Source: CVE Program / CVE List V5
Vulnerability Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-107220
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107220
请登录查看更多情报信息。
Other References for CVE-2026-107220 (3)
-
https://github.com/qax-os/excelize/pull/2379 x_refsource_MISC
-
https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff x_refsource_CONFIRM
Same Patch Batch · qax-os · 2026-10-07 · 15 CVEs total
| CVE-2026-107211 | 8.7 HIGH | Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverabl |
| CVE-2026-107213 | 8.7 HIGH | Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no |
| CVE-2026-107212 | 7.5 HIGH | Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop fo |
| CVE-2026-107214 | 7.5 HIGH | Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks |
| CVE-2026-107216 | 7.5 HIGH | Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entra |
| CVE-2026-107215 | 7.5 HIGH | Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers |
| CVE-2026-107217 | 7.5 HIGH | Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil er |
| CVE-2026-107219 | 7.5 HIGH | Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile |
| CVE-2026-107223 | 7.1 HIGH | Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded pe |
| CVE-2026-107221 | 6.5 MEDIUM | Excelize: a row whose earlier cell has a higher column reference than its last cell panics |
| CVE-2026-107222 | 6.5 MEDIUM | Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no l |
| CVE-2026-107225 | 6.5 MEDIUM | Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml |
| CVE-2026-107224 | 6.5 MEDIUM | Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader |
| CVE-2026-107218 | 5.3 MEDIUM | Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics |
IV. Related Vulnerabilities
Same product: excelize
-
CVE-2026-107225
Excelize: GetStyle panics on a negative fillId, borderId or -
CVE-2026-107224
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/ -
CVE-2026-107223
Excelize: Unbounded <col max> attribute is loaded with no Ma -
CVE-2026-107222
Excelize: GetConditionalFormats indexes conditional-formatti -
CVE-2026-107221
Excelize: a row whose earlier cell has a higher column refer
Same vendor: qax-os
-
CVE-2026-107225
Excelize: GetStyle panics on a negative fillId, borderId or -
CVE-2026-107224
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/ -
CVE-2026-107223
Excelize: Unbounded <col max> attribute is loaded with no Ma -
CVE-2026-107222
Excelize: GetConditionalFormats indexes conditional-formatti -
CVE-2026-107221
Excelize: a row whose earlier cell has a higher column refer
Same weakness: CWE-125
-
CVE-2026-76457
Cisco NX-OS Software Security Hardening Release: October 202 -
CVE-2026-77214
libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBu -
CVE-2026-106061
Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnai -
CVE-2026-65122
NVIDIA TensorRT越界读取漏洞致拒绝服务 -
CVE-2026-19029
HDF5 scale-offset filter heap buffer over-read via crafted c
V. Comments for CVE-2026-107220
No comments yet