CVE-2026-107220

Name of the Vulnerable Software and Affected Versions Excelize versions 2.7.1 through 2.11.0

Description An issue exists where the mergeCellsParser function fails to perform a length check on a cached rectangle when encountering an empty ref attribute in a crafted worksheet. This empty slice is subsequently passed to the cellInRange() function, which attempts to index four positions within the empty slice, leading to a runtime panic (index out of range). This occurs when a non-streaming cell API, such as GetCellValue(), GetCellType(), GetCellFormula(), SetCellValue(), or the in-cell branch of GetPictures(), reads the affected worksheet. The panic occurs on the first cell operation and can crash the process if not handled by a recovery mechanism.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.