Excelize CVE-2026-107218

Exploitation requires the host application to call Excelize's formula engine (CalcCellValue) on attacker-controlled spreadsheet content, and the affected version must be between 2.10.1 and 2.11.0. The precise trigger is a RIGHT() formula evaluated over supplementary-plane (non-BMP, e.g. U+1D7D9) text with a requested character count that falls strictly between the rune (code-point) count and the UTF-16 code-unit count, producing a negative rune-slice index. Limiting factors: applications that never evaluate formulas on untrusted input are not exposed; a Go deferred recover() around formula evaluation mitigates the crash; and the bug only manifests with specific supplementary-plane strings, not ordinary BMP text. No fixed version exists yet, so mitigation currently depends on input filtering or panic recovery.

This is a denial-of-service (availability-only) bug, not a high-priority exploitation target. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 MEDIUM) shows no confidentiality or integrity impact - only a partial availability hit (A:L) from a panic during formula evaluation, consistent with CWE-129 (improper validation of array index). No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The AV:N rating is conditional: it only holds when the consuming application exposes Excelize's formula engine (CalcCellValue) to attacker-supplied spreadsheet content - the library itself has no network listener, so network reach is inherited from the host application rather than intrinsic. The 'Information Disclosure' tag in the input conflicts directly with the CVSS vector (C:N), which indicates no data exposure - this appears mislabeled and should be treated as a DoS issue. Overall real-world risk is low-to-moderate: a crash is recoverable in Go via deferred recover(), and the trigger requires a fairly specific Unicode edge case, so this is a robustness/availability defect worth patching when a fix ships but not an emergency.

An application uses Excelize (2.10.1-2.11.0) to evaluate formulas in user-uploaded spreadsheets. An attacker uploads an XLSX containing a RIGHT() formula applied to supplementary-plane (non-BMP) Unicode text with a character count chosen to fall between the rune count and the UTF-16 code-unit count; when the server calls CalcCellValue, a negative rune-slice index triggers a panic that crashes the evaluation goroutine or process. No public exploit code is identified at time of analysis.