CVE-2026-107225

MEDIUM 6.5

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.

CWE	CWE-20 CWE-129
Vendor	qax-os
Product	excelize
Published	Oct 7, 2026

Stay Ahead of the Next One

Get instant alerts for qax-os excelize

Be the first to know when new medium vulnerabilities affecting qax-os excelize are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

qax-os / excelize

>= 2.8.0, <= 2.11.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65 github.com: https://github.com/qax-os/excelize/pull/2367 github.com: https://github.com/qax-os/excelize/commit/ae2113b410e51f6a141c396a59eda8c42b91bc22