CVE-2026-107222

Name of the Vulnerable Software and Affected Versions Excelize versions 2.7.0 through 2.11.0

Description An issue exists when extracting conditional formats from a crafted worksheet. The GetConditionalFormats() function fails to properly validate the structure of certain rules, specifically cellIs, dataBar, and colorScale. This occurs because the library indexes child slices or dereferences optional children without verifying their existence or length. Specifically, the extractCondFmtCellIs() function may index an empty Formula slice, and the colorScale and dataBar extractors may encounter nil pointers or out-of-range indexes when accessing Cfvo and Color variables. An attacker can exploit this by providing a malformed spreadsheet, causing the application to panic and terminate the process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.