EUVD-2026-94555
GHSA-fw94-4wwp-w8pw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Zip64 XLSX with high-bit uncompressed size
-
ExploitVictim application opens workbook via Excelize
-
ExecutionNegative int64 size bypasses unzip size-limit checks
-
Impactmake() receives negative capacity and panics (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an application using Excelize versions 2.1.0 through 2.11.0 to open an attacker-supplied workbook containing a crafted Zip64 entry whose uncompressed size is declared in the range 2^63 to 2^64-1 (high bit set). No special configuration or non-default option is needed - the overflow occurs on the standard open/read path (ReadZipReader → readFile) against default settings. The principal LIMITING factor is the UI:R requirement: the vulnerable program must be induced to open the malicious file (e.g., via upload, email attachment, or file-processing pipeline); the attacker cannot trigger it without that file being parsed. Impact is confined to a process panic/denial of service with no data exposure or modification. |
| Impact | This is a medium-severity availability-only issue. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity, unauthenticated flaw, but it requires user/application interaction (UI:R - a victim or service must open the attacker-supplied workbook) and yields no confidentiality or integrity impact - only a high availability impact (a Go panic/denial of service during make() with negative capacity). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of widespread or active exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The root cause (CWE-190 integer overflow: a Zip64 uncompressed size of 2^63-2^64-1 wrapping uint64→negative int64 and bypassing size-limit checks) is well characterized by the source-code evidence. CONFLICT TO NOTE: the description states 'No fixed version is available,' yet the input includes PR #2369 and commit db93f8d89 that add a checkFileSize guard rejecting negative sizes - a fix appears merged/imminent even though no release is cited; verify the fixed release with the vendor advisory GHSA-fw94-4wwp-w8pw. Overall this is a legitimate but lower-tier DoS priority, not a critical widely-exploited issue. |
| Exploit ScenarioDerived | An attacker crafts a malicious XLSX (Zip) file whose Zip64 central-directory entry declares an uncompressed size between 2^63 and 2^64-1. When an application built on Excelize opens this workbook, the oversized value is converted to a negative int64, bypasses the unzip size-limit checks, and is passed to make() as a negative capacity, triggering a runtime panic. No public exploit code was identified in the provided data, but the crafted-file technique is straightforward given the documented root cause. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Opening a crafted workbook with the Excelize Go library (versions 2.1.0 through 2.11.0) triggers an integer-overflow panic that crashes the process, producing a denial of service. A Zip64 entry whose declared uncompressed size falls between 2^63 and 2^64-1 wraps to a negative int64, slips past the library's size-limit checks, and is passed to an allocation as a negative capacity; the crash occurs on the standard open/read path with default options and no credentials. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5) reflects that remote attackers can deliver the file but the victim application must be induced to parse it, and that only availability is affected - there is no data exposure or modification, and no public exploit has been identified at time of analysis.
RemediationAI
No vendor-released patched version was available at time of analysis - the advisory states no fixed release exists as of this review - but an upstream fix is available as a PR/commit (PR 2369, commit db93f8d89de71589069a54d1b998af02e3c5f7cd), which adds checkFileSize logic rejecting negative fileSize and invalid UnzipSizeLimit values; released patched version is not independently confirmed, so pin to a commit containing that change or vendor the patch. Do not rely on setting Options.UnzipSizeLimit as a mitigation, since the wrapped negative size bypasses the pre-fix limit comparison; you can, however, run a pre-validation pass that rejects XLSX/ZIP entries declaring UncompressedSize64 with bit 63 set (>= 2^63) or whose declared size conflicts with the actual stream, using a hardened ZIP parser before Excelize touches the file. Wrap calls to OpenReader/OpenFile in a deferred recover so the makeslice panic is converted to an error instead of terminating the process, and isolate all untrusted workbook parsing in a separate process or container with a supervisor that restarts on crash and with CPU/memory caps - the trade-off is added operational complexity and latency. Blocking end-user delivery of untrusted .xlsx files or gating imports behind explicit review reduces exposure where the parsing path cannot be isolated. Consult GHSA-fw94-4wwp-w8pw for the authoritative fix status before deciding on a permanent upgrade target.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-190 (Integer Overflow or Wraparound) in Excelize's XLSX container handling. XLSX files are ZIP archives, and Excelize reads them through Go's archive/zip package via ReadZipReader, which iterates zip.File entries and inspects FileInfo.Size. For Zip64 entries, the true size is carried in the UncompressedSize64 uint64 field; when that value has bit 63 set (declared size in the 2^63..2^64-1 range), converting it to the signed int64 returned by FileInfo.Size produces a negative number. The library's only guard at the time was a comparison of the accumulated unzip size against Options.UnzipSizeLimit, which a negative value trivially undercuts, so the wrapped size flowed through readFile into make([]byte, size) as a negative capacity and Go's runtime panicked on the invalid slice capacity. The upstream fix (PR #2369, commit db93f8d89de71589069a54d1b998af02e3c5f7cd) introduces a checkFileSize helper that rejects a negative UnzipSizeLimit, a negative fileSize, and a fileSize exceeding the limit before the allocation, and adds regression tests covering negative and over-limit inputs. Note that the supplied tag 'Authentication Bypass' is inconsistent with the assessed vector, which specifies no confidentiality or integrity impact - this is purely an availability defect and should not be read as an access-control bypass.
Know when Excelize gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Crafted file is attacker-supplied but must be opened by the app (UI:R); no auth needed (PR:N) on the default parse path; impact is a panic/DoS only, so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of service in the Excelize Go library (github.com/xuri/excelize/v2, a.k.a. qax-os/excelize) before 2.11.0 allows
Denial of service in the Excelize Go library (versions 2.1.0 through 2.11.0) allows an attacker-controlled spreadsheet t
A crafted Excel (.xlsx) file can crash any Go application that parses it with Excelize 2.0.0 through 2.11.0 using a non-
Uncontrolled memory and CPU consumption in Excelize (qax-os/excelize), the widely used Go library for reading and writin
Denial of service in Excelize 2.9.0 through 2.11.0 allows a crafted spreadsheet to panic and terminate a Go process that
Go slice-bounds panic in the Excelize spreadsheet library versions 2.8.1 through 2.11.0 lets a crafted .xlsx workbook cr
Denial of service in the Excelize Go library (versions 2.3.1 through 2.11.0) allows unauthenticated remote attackers to
Denial of service in the Excelize Go spreadsheet library (github.com/xuri/excelize/v2 2.0.0-2.11.0 and github.com/xuri/e
Uncontrolled recursion in the Excelize Go library (versions 2.8.1 through 2.11.0) allows a fatal Go stack overflow that
Denial of service in Excelize versions 2.3.1 through 2.11.0 allows unauthenticated remote attackers to terminate the cal
Memory exhaustion and runtime panic in the Excelize Go library (versions 2.3.1 through 2.11.0) let unauthenticated remot
Resource exhaustion in the Excelize Go library (versions 2.1.0 through 2.11.0) lets a crafted .xlsx workbook drive exces
Exploit-DB