CVE-2026-107214

Name of the Vulnerable Software and Affected Versions Excelize versions 2.3.1 through 2.11.0

Description Insufficient structural and parameter validation occurs during the decryption dispatch process. The Decrypt function passes attacker-controlled EncryptionInfo and EncryptedPackage data into standardDecrypt() or agileDecrypt() without proper validation. When a malformed OLE compound file containing a version-valid EncryptionInfo stream is processed, it can trigger unrecovered Go runtime panics across nine different malformed-input classes, enabling an attacker to terminate the calling process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.