CVE-2026-107219

Name of the Vulnerable Software and Affected Versions Excelize versions 2.3.1 through 2.11.0

Description An issue exists in the agile decryption process where the library accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. When the OpenFile function is called on a crafted OLE encrypted-workbook header, it reaches the agileDecrypt function, which passes the unbounded spinCount to the convertPasswdToKey() function. Because the spinCount is filled via xml.Unmarshal without bounds, an attacker can supply an excessive value to force the key-derivation loop to perform unbounded work. This process cannot be cancelled as the execution path does not utilize context.Context, allowing an attacker to consume a CPU core for a controlled duration, leading to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.