EUVD-2026-94533
GHSA-x2q3-8cjh-766f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUpload crafted encrypted XLSX
-
ExploitTrigger unchecked stream-size allocation
-
ImpactPanic or exhaust process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | The affected application must invoke Excelize's Decrypt path on an attacker-supplied, password-protected/encrypted OLE compound (CFB) Excel file - i.e., it must accept and attempt to decrypt untrusted encrypted workbooks. The trigger is a crafted CFB directory entry for the EncryptionInfo or EncryptedPackage stream whose declared streamSize is negative or extremely large, which reaches make() before any sector-chain or size-domain validation (the unpatched extractPart). Limiting factors: only encrypted-workbook processing flows are reachable (non-encrypted spreadsheet parsing does not hit this path), impact is confined to availability (crash/OOM) with no code execution or data exposure, and library versions 2.3.1 through 2.11.0 are affected. |
| Impact | This is a denial-of-service memory-allocation flaw (CWE-789) in the Excelize Go library's encrypted-spreadsheet decryption path. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: no privileges, no user interaction, and availability-only impact (process panic via make() with a negative length, or multi-gigabyte allocation exhausting memory) with no confidentiality or integrity consequence. No EPSS score, SSVC decision, or KEV entry was supplied, and no public exploit is indicated - so despite the 'HIGH' rating this is availability-only with no evidence of active exploitation, placing it well below KEV-class or RCE priorities. The practical risk is bounded by a deployment precondition the raw CVSS does not capture: the vulnerable code sits in the Decrypt/extractPart path, so only applications that accept and decrypt untrusted password-protected OLE/CFB Excel files are exposed. Conflicting signal to flag: the input Tags label this 'Information Disclosure,' which directly contradicts the CVSS impact metrics (C:N/I:N/A:H) and the CWE-789 memory-exhaustion mechanism - this is a DoS, not disclosure. No fixed release version exists yet (a patch is staged in PR #2396), so remediation currently requires pinning the patched commit or input validation. |
| Exploit ScenarioDerived | An application uses Excelize to open user-uploaded, password-protected Excel workbooks. An attacker uploads a crafted OLE compound file whose EncryptionInfo or EncryptedPackage directory entry declares a negative or enormous stream size, and the service either panics (negative make length) or balloons to a multi-gigabyte allocation, crashing or starving the host. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Memory exhaustion and runtime panic in the Excelize Go library (versions 2.3.1 through 2.11.0) let unauthenticated remote attackers crash or drive out-of-memory conditions in any service that decrypts attacker-supplied, password-protected OLE compound (CFB) Excel workbooks. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms no privileges or user interaction are needed and that impact is confined to availability, with no code execution or data exposure. No vendor-tagged fixed release was available as of this review, though an upstream fix exists as PR #2396 / commit 5f636f9; no public exploit code was identified at time of analysis and there is no KEV listing.
RemediationAI
No vendor-tagged fixed release was identified at time of analysis, so the primary fix is upstream fix available (PR #2396 / commit 5f636f9dcde55911f14290060b017f0cc88cd694); the released patched version is not independently confirmed. Apply that commit as a vendor patch or Go module replace directive (it bounds allocations to min(len(raw), MaxCFBStreamSizeV3 or MaxCFBStreamSizeV4) and returns ErrWorkbookFileFormat for negative or oversized EncryptionInfo/EncryptedPackage entries), then upgrade to the first tagged Excelize release after 2.11.0 that contains it once published, verifying the fix's presence rather than assuming it. Until then, the most effective control is to avoid feeding untrusted encrypted workbooks to Decrypt: if the application only expects plaintext .xlsx, reject CFB containers outright by checking for the D0 CF 11 E0 A1 B1 1A E1 magic before parsing, accepting the trade-off that legitimate password-protected files will also be refused. As a containment measure, run workbook parsing in a sandboxed subprocess under a hard cgroup/ulimit memory cap with restart-on-crash so the multi-gigabyte allocation path terminates the worker instead of the host, at the cost of needing higher limits for legitimately large files and added process-management complexity. Enforce a strict maximum accepted upload size at the API boundary (trade-off: oversized legitimate workbooks are rejected), and wrap the Decrypt call in a recover() so the negative-size 'makeslice: len out of range' panic is converted into a handled error - noting explicitly that recover() does not protect against the allocation-exhaustion variant, which ends in a fatal OOM error the runtime cannot recover. Reference the advisory at https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Excelize decrypts ECMA-376 encrypted workbooks by opening the container as a Microsoft Compound File Binary (CFB/OLE2) document via the mscfb reader and then locating two directory-entry streams, EncryptionInfo and EncryptedPackage, which carry the Standard or Agile encryption metadata and ciphertext. The vulnerable helper extractPart iterates CFB directory entries and, before any sector-chain or size-domain validation, executes make([]byte, entry.Size) using the attacker-controlled streamSize field from the directory entry. Because that field is fully attacker-controlled, a crafted compound file can declare a negative size (which aborts inside Go's runtime with a 'makeslice: len out of range' panic) or an extremely large size (which forces a multi-gigabyte allocation and process memory exhaustion). This is the CWE-789 class, Memory Allocation with Excessive Size Value: the allocation is sized from an untrusted header value rather than being bounded by the actual file length or by format-defined maxima. The upstream patch computes maxStreamSize as the minimum of the real input length and the CFB version-appropriate ceiling (MaxCFBStreamSizeV3 = 2^31-1 for version 3, read from bytes 26:28 of the CFB header, and MaxCFBStreamSizeV4 = 0xFFFFFFFA000 for version 4), then rejects both EncryptionInfo and EncryptedPackage entries where entry.Size < 0 or maxStreamSize < entry.Size, returning ErrWorkbookFileFormat. Note that the flaw is reachable only through the Decrypt path; ordinary parsing of unencrypted spreadsheets does not touch extractPart.
Know when Excelize gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated parsing of a remotely supplied encrypted file (AV:N/AC:L/PR:N/UI:N) causing only panic/memory exhaustion, so A:H with C:N/I:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review.
Technical POC Analysis
CWE-789 (Memory Allocation with Excessive Size Value), realized in Excelize as a negative-or-unbounded allocation from attacker-controlled data.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Excelize Go library (versions 2.3.1 through 2.11.0) contains a high-severity memory exhaustion and runtime panic vulnerability that can be triggered remotely by unauthenticated attackers through password-protected OLE compound Excel workbooks. Any business service that uses this library to decrypt user-supplied encrypted Excel files is at risk of denial-of-service, potentially causing downtime and disrupting critical operations. Leadership should prioritize patching or mitigating this issue because it can be exploited without authentication or user interaction, impacting availability.
No vendor-released patch identified at time of analysis; interim mitigations include enforcing strict memory limits and timeouts on file-processing services, rate limiting requests, blocking password-protected CFB Excel uploads from untrusted sources, sandboxing decryption processes, and monitoring for crashes or memory exhaustion. Apply upstream fix (PR #2396 / commit 5f636f9) only after testing, and deploy vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Denial of service in the Excelize Go library (github.com/xuri/excelize/v2, a.k.a. qax-os/excelize) before 2.11.0 allows
Denial of service in the Excelize Go library (versions 2.1.0 through 2.11.0) allows an attacker-controlled spreadsheet t
A crafted Excel (.xlsx) file can crash any Go application that parses it with Excelize 2.0.0 through 2.11.0 using a non-
Uncontrolled memory and CPU consumption in Excelize (qax-os/excelize), the widely used Go library for reading and writin
Denial of service in Excelize 2.9.0 through 2.11.0 allows a crafted spreadsheet to panic and terminate a Go process that
Go slice-bounds panic in the Excelize spreadsheet library versions 2.8.1 through 2.11.0 lets a crafted .xlsx workbook cr
Denial of service in the Excelize Go library (versions 2.3.1 through 2.11.0) allows unauthenticated remote attackers to
Denial of service in the Excelize Go spreadsheet library (github.com/xuri/excelize/v2 2.0.0-2.11.0 and github.com/xuri/e
Uncontrolled recursion in the Excelize Go library (versions 2.8.1 through 2.11.0) allows a fatal Go stack overflow that
Denial of service in Excelize versions 2.3.1 through 2.11.0 allows unauthenticated remote attackers to terminate the cal
Resource exhaustion in the Excelize Go library (versions 2.1.0 through 2.11.0) lets a crafted .xlsx workbook drive exces
Panic-triggering denial of service in the Excelize Go library (all versions prior to 2.11.0) allows any actor who can su
Exploit-DB