CVE-2026-107217

Name of the Vulnerable Software and Affected Versions github.com/xuri/excelize/v2 versions 2.0.0 through 2.11.0 github.com/xuri/excelize versions 1.1.0 through 1.4.1

Description An issue exists where the ColumnNameToNumber() function accumulates a bijective base-26 value in an int64 without detecting overflow. This allows a specifically crafted long column name, such as VGWQHXLSDVIKWV, to wrap to zero without triggering an error. When a worksheet containing such an overflowing column name is processed by the checkSheetR0() or checkRow() functions, the wrapped zero value results in a negative slice index during normalization. This leads to a runtime panic (index out of range [-1]), which terminates the calling process. This can be triggered via any workSheetReader-based API, including GetCellValue(), GetCellFormula(), SetCellValue(), GetMergeCells(), GetSheetDimension(), GetColWidth(), and AddTable(), when processing a malicious .xlsx file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.