Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/qax-os/excelize/commit/a54c578af309fa81f448143ed2b7a91192cc58a7 Patch
- https://github.com/qax-os/excelize/pull/2370 Issue Tracking, Patch
- https://github.com/qax-os/excelize/security/advisories/GHSA-fq3v-74gv-27gm Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.1 · excelizeNVD modified 2026-10-13 14:18
Affected (CPE criteria) 1
cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:*
References 3
- https://github.com/qax-os/excelize/commit/a54c578af309fa81f448143ed2b7a91192cc58a7 Patch
- https://github.com/qax-os/excelize/pull/2370 Issue Tracking, Patch
- https://github.com/qax-os/excelize/security/advisories/GHSA-fq3v-74gv-27gm Exploit, Vendor Advisory