CVE-2026-54063— Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
Possible ATT&CK Techniques 2AI
T1068 · Exploitation for Privilege Escalation T1496 · Resource HijackingGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-54063
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
Source: NVD (National Vulnerability Database)
Vulnerability Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled <row r="N"> XML attribute value directly as the length argument to make([]xlsxRow, row) without validating it against the Excel row limit (TotalRows = 1,048,576). A specially crafted XLSX file can trigger two denial-of-service variants: (A) an out-of-memory process kill when r=2147483647 forces a ~16 GB allocation attempt, and (B) a runtime panic via out-of-bounds slice indexing when r=-1. Any service that opens attacker-supplied XLSX files and calls GetCellValue is affected. No authentication is required. This issue is fixed in version 2.11.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
不加限制或调节的资源分配
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-54063
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 9719 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-54063
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54063 (1)
Vendor Pages for CVE-2026-54063 (1)
- 🔗 Release v2.11.0 · qax-os/excelize · GitHubx_refsource_MISC
Same Patch Batch · qax-os · 2026-07-10 · 3 CVEs total
| CVE-2026-59161 | Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation | |
| CVE-2026-59162 | Excelize: Negative shared-string index causes panic in GetCellValue and GetRows |
IV. Related Vulnerabilities
Same weakness: CWE-770
- CVE-2026-61465
ImageMagick before 7.1.2-26 Memory Allocation Policy Bypass - CVE-2026-57220
RabbitMQ: Stream listener does not enforce configured frame- - CVE-2026-57212
RabbitMQ management HTTP API accepts request bodies larger t - CVE-2026-53653
Grav: Unauthenticated denial of service via unbounded image - CVE-2026-58661
n8n - Disk Space Exhaustion via Data-Table File Upload Endpo
V. Comments for CVE-2026-54063
No comments yet