CVE-2026-107224

Name of the Vulnerable Software and Affected Versions Excelize versions 2.1.0 through 2.11.0

Description An issue exists when processing Zip64 entries where an uncompressed size with the high bit set (ranging from 2^63 through 2^64-1) is converted from a uint64 to a negative int64. This conversion occurs within the ReadZipReader function, which obtains the size via FileInfo.Size. Because the resulting value is negative, it bypasses signed size-limit checks and guards intended to prevent excessive decompression. Consequently, this negative value is passed to the readFile function and used as a capacity argument in a make slice operation. This leads to a runtime panic (makeslice: cap out of range) during the execution of OpenFile or OpenReader, allowing an attacker to crash the calling goroutine by providing a specially crafted workbook.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.