EUVD-2026-94556
GHSA-5h23-36rv-pm65
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft XLSX with negative fillId/borderId/fontId
-
DeliveryDeliver file to vulnerable app
-
ExploitApplication calls GetStyle on cell
-
ExecutionNegative value used as slice index
-
ImpactRuntime panic crashes application (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | The application must use Excelize version 2.8.0 through 2.11.0 and must call File.GetStyle on a cell whose style references a crafted styles.xml containing a negative fillId, borderId, or fontId; the negative value then passes the upper-bound-only extractStyleCondFuncs predicate and becomes a negative slice index. LIMITING FACTORS: the app must ingest and parse an attacker-controlled .xlsx and actively read cell styling (UI:R), so purely display-only or non-style-reading workflows are not affected; impact is limited to a panic/denial of service with no code execution, no confidentiality, and no integrity impact. No authentication is required (PR:N), but no fixed release exists yet, so mitigation requires recovering from panics or applying the PR #2367 patch manually. |
| Impact | This is a moderate, availability-only issue rather than a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity, unauthenticated flaw whose entire impact is denial of service (a Go runtime panic) - there is no confidentiality or integrity impact. Exploitation requires user/application interaction (UI:R): a vulnerable app must actually parse an attacker-supplied spreadsheet and call File.GetStyle. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, and no standalone public exploit is identified - only the vendor's own PR #2367 includes a regression test that demonstrates the crash. The signals are consistent (library bug, DoS only, well understood root cause) with no conflicts, but note the 'Information Disclosure' tag contradicts the CVSS vector, which shows C:N/I:N - this is a crash, not a disclosure. Net: a real bug worth patching in any service that ingests untrusted XLSX files, but it is a crash/DoS, not an RCE or data-exposure emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious .xlsx whose styles.xml specifies a negative fillId, borderId, or fontId, then submits or sends it to a service or user running a vulnerable Excelize version (2.8.0-2.11.0). When the application reads the cell styling via GetStyle, the negative identifier passes the upper-bound-only check and is used as a negative slice index, triggering a Go panic that crashes the handling goroutine or process. A proof-of-concept-style regression test demonstrating the panic is included in PR #2367, though no weaponized standalone exploit has been reported. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A negative index panic in the Go Excelize library (versions 2.8.0 through 2.11.0) allows unauthenticated remote attackers to cause a denial of service when an application reads cell styling from a crafted .xlsx file. The flaw arises because GetStyle's extraction predicates for fill, border, and font IDs only validate upper bounds, permitting negative fillId, borderId, or fontId values from attacker-controlled styles.xml to reach slice indexing and trigger a panic. No fixed version is available, though an upstream patch (PR #2367) exists; no public exploit has been identified, and exploitation requires the application to parse an untrusted file and call File.GetStyle (UI:R).
RemediationAI
No vendor-released patch is available at time of analysis. The upstream fix is available as a pull request (#2367) and commit (ae2113b410e51f6a141c396a59eda8c42b91bc22), which adds lower-bound checks (0 <= FillID/BorderID/FontID) before slice indexing; organizations can manually apply this patch or cherry-pick the commit. As a temporary compensating control, applications can wrap GetStyle calls in panic recovery to prevent crashes from malformed styles.xml, though this does not eliminate the underlying flaw and may mask other issues. Additionally, treat all uploaded .xlsx files as untrusted and avoid calling GetStyle on attacker-supplied content when possible; if style reading is necessary, pre-validate the styles.xml for negative fillId, borderId, or fontId values before processing. Note that these mitigations have trade-offs: panic recovery may still cause availability issues if panics are frequent, and input validation may be bypassed if not comprehensive. Monitor the advisory for a fixed release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Excelize is a Go library for reading and writing Microsoft Excel spreadsheets. The vulnerability is in the GetStyle function and the extractStyleCondFuncs predicates used to extract style information. CWE-20 (Improper Input Validation) is the root cause: the predicates check only upper bounds (e.g., *xf.FillID < len(s.Fills.Fill)) without verifying that the index is non-negative. When a crafted styles.xml contains a negative fillId, borderId, or fontId, the value passes the upper-bound-only check and is used as a negative slice index, causing a Go runtime panic (index out of range). The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates a network attack vector, low complexity, no privileges required, but user interaction is needed because the victim must open or process a malicious .xlsx file and the application must actively read cell styling. Impact is limited to availability (panic/denial of service) with no confidentiality or integrity impact. The CPE qax-os:excelize confirms the affected product, and the vulnerability is specific to versions 2.8.0 through 2.11.0 as stated in the advisory.
Know when Excelize gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
A crafted file is delivered remotely (AV:N) and reliably triggers the negative-index panic (AC:L) without auth (PR:N) but requires the app to parse and read the file (UI:R); impact is DoS only, so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Denial of service in the Excelize Go library (github.com/xuri/excelize/v2, a.k.a. qax-os/excelize) before 2.11.0 allows
Denial of service in the Excelize Go library (versions 2.1.0 through 2.11.0) allows an attacker-controlled spreadsheet t
A crafted Excel (.xlsx) file can crash any Go application that parses it with Excelize 2.0.0 through 2.11.0 using a non-
Uncontrolled memory and CPU consumption in Excelize (qax-os/excelize), the widely used Go library for reading and writin
Denial of service in Excelize 2.9.0 through 2.11.0 allows a crafted spreadsheet to panic and terminate a Go process that
Go slice-bounds panic in the Excelize spreadsheet library versions 2.8.1 through 2.11.0 lets a crafted .xlsx workbook cr
Denial of service in the Excelize Go library (versions 2.3.1 through 2.11.0) allows unauthenticated remote attackers to
Denial of service in the Excelize Go spreadsheet library (github.com/xuri/excelize/v2 2.0.0-2.11.0 and github.com/xuri/e
Uncontrolled recursion in the Excelize Go library (versions 2.8.1 through 2.11.0) allows a fatal Go stack overflow that
Denial of service in Excelize versions 2.3.1 through 2.11.0 allows unauthenticated remote attackers to terminate the cal
Memory exhaustion and runtime panic in the Excelize Go library (versions 2.3.1 through 2.11.0) let unauthenticated remot
Resource exhaustion in the Excelize Go library (versions 2.1.0 through 2.11.0) lets a crafted .xlsx workbook drive exces
Exploit-DB