Excelize CVE-2026-107214

Exploitation requires the host application to call Excelize's Decrypt on an attacker-supplied file (e.g. opening or decrypting an uploaded, password-protected .xlsx), and the malicious OLE compound file must contain a version-valid EncryptionInfo stream so that dispatch proceeds into standardDecrypt or agileDecrypt. The vulnerable code path is only reached for the encrypted-workbook decryption flow - applications that never process encrypted/untrusted spreadsheets are not exposed. Limiting factors: the attacker needs a channel to get the file to the decryption routine, affected versions are Excelize 2.3.1 through 2.11.0, and the worst-case outcome is process termination only (no code execution or data disclosure). No fixed version exists, so mitigation must occur at the application layer (validating or sandboxing untrusted file processing).

All impact signals point to a single outcome - denial of service. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) and CWE-248 (uncaught exception) agree: there is no confidentiality or integrity impact, only availability loss via an unrecovered Go runtime panic that terminates the calling process. The 'network' attack vector is nominal - it reflects that a malicious file can be delivered remotely (e.g. uploaded to a service that decrypts it), not that the library listens on a socket; real exploitation always requires the victim application to open or pass an attacker-supplied spreadsheet to Decrypt. No EPSS score, KEV listing, or POC was provided in the input, so there is no public evidence of active exploitation; the risk is a reliability/crash issue rather than a code-execution or data-breach threat. The one aggravating factor is that no fixed version exists as of this review, so affected deployments cannot remediate by upgrading and must mitigate at the application layer. Net assessment: a genuine but bounded DoS - a real priority only for services that decrypt untrusted, encrypted Excel files; low urgency for applications that never process untrusted encrypted input. NOTE: EPSS data is absent, so exploitation probability cannot be quantified.

An attacker uploads or supplies a malformed OLE compound file that carries a version-valid EncryptionInfo stream to an application that uses Excelize to open or decrypt spreadsheets. When the application calls Decrypt, the attacker-controlled EncryptionInfo and EncryptedPackage data reach standardDecrypt or agileDecrypt before validation, hitting one of nine malformed-input classes that causes an unrecovered Go runtime panic and crashes the process. No public exploit was identified at time of analysis, though the patch PR (#2395) and its test cases effectively document the triggering inputs.