CVE-2026-107225

Name of the Vulnerable Software and Affected Versions Excelize versions 2.8.0 through 2.11.0

Description An issue exists in the File.GetStyle function where the library fails to validate the lower bounds of style-table indices extracted from the styles.xml file of a workbook. Specifically, the predicates used for extracting fill, border, and font styles only check the upper bounds of the indices. If a crafted .xlsx file contains negative values for the fillId, borderId, or fontId attributes, these values are used as negative slice indices. Because the library does not implement a recovery mechanism, this leads to a runtime panic (index out of range), causing the calling application to crash. This affects the ordinary read path, including cell styling, style-copying, and rendering.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.