{"id":"EUVD-2026-42938","enisaUuid":"67933a83-a96a-3537-ad57-50b5723bda65","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled \u003crow r\u003d\"N\"\u003e XML attribute value directly as the length argument to make([]xlsxRow, row) without validating it against the Excel row limit (TotalRows \u003d 1,048,576). A specially crafted XLSX file can trigger two denial-of-service variants: (A) an out-of-memory process kill when r\u003d2147483647 forces a ~16 GB allocation attempt, and (B) a runtime panic via out-of-bounds slice indexing when r\u003d-1. Any service that opens attacker-supplied XLSX files and calls GetCellValue is affected. No authentication is required. This issue is fixed in version 2.11.0.","datePublished":"Jul 10, 2026, 3:53:31 PM","dateUpdated":"Jul 10, 2026, 6:39:48 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-h69g-9hx6-f3v4\nhttps://github.com/qax-os/excelize/releases/tag/v2.11.0\n","aliases":"CVE-2026-54063\nGHSA-h69g-9hx6-f3v4\n","assigner":"GitHub_M","epss":0.61,"enisaIdProduct":[{"id":"576136af-3b58-3469-86b1-86b5995d5d54","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"\u003c 2.11.0"}],"enisaIdVendor":[{"id":"78d4f6ed-d503-342d-9e10-4364768e86d1","vendor":{"name":"qax-os"}}],"enisaIdVulnerability":[{"id":"6d4411f5-6ade-33e0-b869-9c0b14a0c0e7","vulnerability":{"id":"CVE-2026-54063","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled \u003crow r\u003d\"N\"\u003e XML attribute value directly as the length argument to make([]xlsxRow, row) without validating it against the Excel row limit (TotalRows \u003d 1,048,576). A specially crafted XLSX file can trigger two denial-of-service variants: (A) an out-of-memory process kill when r\u003d2147483647 forces a ~16 GB allocation attempt, and (B) a runtime panic via out-of-bounds slice indexing when r\u003d-1. Any service that opens attacker-supplied XLSX files and calls GetCellValue is affected. No authentication is required. This issue is fixed in version 2.11.0.","datePublished":"Jul 10, 2026, 3:53:31 PM","dateUpdated":"Jul 10, 2026, 6:39:48 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-h69g-9hx6-f3v4\nhttps://github.com/qax-os/excelize/releases/tag/v2.11.0\n","enisa_id":"EUVD-2026-42938\n","assigner":"GitHub_M","epss":0.61,"dataProcessed":"Nov 7, 2026, 7:20:27 AM","vulnerabilityProduct":[{"id":"2ad979f9-f226-3c6c-a3bb-3d2c36d117a4","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"\u003c 2.11.0"}],"vulnerabilityVendor":[{"id":"01214924-9840-3672-92b9-1a6219a32fec","vendor":{"name":"qax-os"}}]}},{"id":"86827b2f-f71b-316d-9707-e6e5057e765f","vulnerability":{"id":"GHSA-h69g-9hx6-f3v4","description":"Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)","datePublished":"Jul 10, 2026, 7:25:20 PM","dateUpdated":"Jul 10, 2026, 7:25:20 PM","baseScore":0.0,"references":"https://github.com/qax-os/excelize/security/advisories/GHSA-h69g-9hx6-f3v4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54063\nhttps://github.com/qax-os/excelize\nhttps://github.com/qax-os/excelize/releases/tag/v2.11.0\n","enisa_id":"EUVD-2026-42938\n","aliases":"CVE-2026-54063\nGHSA-h69g-9hx6-f3v4\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}