Excelize EUVD-2026-94552

Exploitation requires that the host application (1) ingest an attacker-controlled spreadsheet and (2) explicitly call GetConditionalFormats on it; the crafted worksheet must contain a cellIs rule lacking its formula, a dataBar rule missing Cfvo/Color children, or a colorScale rule that is absent or declares three colors with fewer than three cfvo value objects. Only Excelize versions 2.7.0 through 2.11.0 are affected and no fixed version exists yet. Limiting factors: the application must actually invoke the conditional-format extraction path (UI:R), the impact is confined to a process panic (availability only), and a host that wraps the call in a Go recover() or isolates parsing in a sandboxed worker can prevent full process termination.

This is a medium-severity denial-of-service issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) correctly reflects a remote, unauthenticated, low-complexity panic with availability-only impact and no confidentiality or integrity loss (C:N/I:N) - consistent with CWE-129 (improper validation of array index) and the nil-dereference/out-of-range crashes described. No EPSS score was provided in the input, so exploitation probability cannot be quantified. KEV status is not present (treated as NO) and no public exploit is listed, though the fix PR #2375 and its added test cases publicly demonstrate the exact crafted-worksheet inputs that trigger the crash. The key risk-tempering facts are: impact is limited to a process panic (not RCE or data exposure), exploitation requires UI:R - the host application must both ingest an attacker-controlled spreadsheet and specifically call GetConditionalFormats - and in Go a panic can be contained with recover(), so well-architected services may degrade gracefully rather than terminate. The notable aggravating factor is that the description states no fixed version is available as of review, leaving no clean upgrade path. Net: a legitimate but moderate-priority availability bug for services that parse untrusted spreadsheets, not a high-urgency item despite AV:N.

An attacker uploads a crafted .xlsx file to a web service that uses Excelize to inspect conditional formatting (e.g., a document-processing or reporting backend). The file contains a cellIs, dataBar, or colorScale rule missing its expected child elements; when the service calls GetConditionalFormats, Excelize indexes an empty slice or dereferences a nil colorScale and panics, terminating the unprotected worker process. No public weaponized exploit is identified, but the fix PR's test cases publicly document the exact triggering payloads.