PT-2026-56151 · Excelize · Excelize
CVE-2026-54063
·
Published
2026-07-07
·
Updated
2026-08-10
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Excelize versions prior to 2.11.0
Description
The
checkSheet() function in github.com/xuri/excelize/v2 fails to validate the <row r="N"> XML attribute value before using it as the length argument for a slice allocation in make([]xlsxRow, row). This lack of validation against the Excel row limit (TotalRows = 1,048,576) allows an unauthenticated attacker to cause a denial-of-service by providing a specially crafted XLSX file. This is triggered when a service opens the file and calls GetCellValue (or any API that internally invokes workSheetReader).Two exploitation variants exist:
- Out-of-memory (OOM) process kill: Setting
r=2147483647forces an allocation attempt of approximately 16 GB, leading the Go runtime to terminate the process. - Runtime panic: Setting
r=-1causes an out-of-bounds slice indexing error, resulting in a process crash.
Recommendations
Update Excelize to version 2.11.0.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Excelize