Excelize EUVD-2026-94549

Exploitation requires that the target application open an attacker-supplied, agile-encrypted (OOXML agile encryption) .xlsx workbook via Excelize OpenFile with decryption attempted - the crafted file must carry an OLE encrypted-workbook header whose KeyEncryptor EncryptedKey declares an excessively large spinCount, which is then fed unbounded to convertPasswdToKey before verifier validation. Limiting factors: only Excelize versions 2.3.1 through 2.11.0 are affected; the workbook must use agile encryption and the application must actually invoke decryption (i.e., supply/attempt a password on an encrypted file), so plain unencrypted spreadsheet handling is not reachable; and impact is bounded to one CPU core per malicious file rather than a full host outage. No authentication or user privileges are required to supply the file, but realistic network exploitation depends on the service auto-ingesting untrusted encrypted spreadsheets.

This is a genuine but moderate-priority availability issue, not a critical system-takeover flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) indicates a network-reachable, low-complexity, unauthenticated condition with availability-only impact (CWE-400 uncontrolled resource consumption), which is consistent with the description: a crafted encrypted workbook forces an unbounded, uncancellable password-key-derivation loop. However, several signals temper the raw 7.5 score. No EPSS probability was provided, no CISA KEV listing applies, and no public exploit was flagged in the input, so there is no evidence of active or widespread exploitation. The A:H rating is arguably generous: the description states the impact is consumption of a single CPU core for an attacker-controlled duration, which is degraded performance/partial DoS rather than a full outage on multi-core hosts - I would independently assess availability as A:L (see assessed vector). The AV:N rating also depends on deployment: Excelize is a library, so network exploitability is only realistic when a service automatically ingests and decrypts attacker-supplied .xlsx files; in a desktop/offline tool the realistic vector is lower. Net: treat as a medium-priority hardening fix for any service that decrypts untrusted encrypted spreadsheets, but not an emergency.

An attacker uploads a malicious encrypted .xlsx file to a web service that uses Excelize to open and decrypt spreadsheets (e.g., a document-processing or import endpoint). The crafted OLE encrypted-workbook header declares an excessive spinCount, and when the service calls OpenFile and reaches agileDecrypt/convertPasswdToKey, the key-derivation loop spins for the attacker-chosen number of iterations, pinning a CPU core and degrading service for a sustained period. No public exploit was identified at time of analysis, though the upstream fix PR (#2389) and its test case clearly reveal the triggering mechanism.