Excelize EUVD-2026-94550

Exploitation requires an application built with Excelize 2.7.1 through 2.11.0 to parse an attacker-controlled worksheet whose XML contains a mergeCell element with an empty 'ref' attribute, AND to then invoke a non-streaming cell-reading API (such as GetCellValue) that reaches mergeCellsParser. Limiting factors: the workbook must be processed by the victim application (UI:R - no fully autonomous remote trigger), and streaming cell APIs that do not route through mergeCellsParser/cellInRange are not affected. There is no authentication requirement in the library itself (PR:N), but real-world exposure depends on whether the embedding application accepts untrusted spreadsheet input.

This is a moderate-severity denial-of-service issue, not a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 6.5) correctly reflects an availability-only impact (a Go panic / crash) with no confidentiality or integrity loss, gated by required user interaction (UI:R) - a victim application must read an attacker-supplied worksheet. Despite AV:N, exploitation is not purely remote-automatic: the attacker must get a crafted .xlsx file processed by an application that embeds the vulnerable Excelize versions (2.7.1-2.11.0) and calls a non-streaming cell API. No EPSS score, SSVC decision, or CISA KEV status was provided in the input, and there is no public exploit identified at time of analysis - only a vendor fix (PR #2379 / commit 99903a3) and a regression test, which is a patch artifact rather than weaponized exploit code. Note a conflict to verify: the 'Information Disclosure' tag contradicts the CVSS vector (C:N), and the 'Buffer Overflow' tag is imprecise - CWE-125 out-of-bounds read here produces a crash, not memory disclosure or code execution. Overall this warrants routine patching prioritization for teams whose Go services parse untrusted spreadsheets, not crisis response.

An attacker crafts a malicious Excel workbook containing a mergeCell element with an empty 'ref' attribute and gets it uploaded to or opened by a backend service that uses Excelize to read cell values (e.g., an invoice/report ingestion pipeline). When the service calls a non-streaming API such as GetCellValue, mergeCellsParser hands an empty rectangle slice to cellInRange, which indexes four out-of-bounds positions and panics, crashing the processing routine. No public exploit code is identified at time of analysis, though the trigger is trivial to construct from the public patch and test case.