{"id":"EUVD-2026-94533","enisaUuid":"ed1fbb84-e91f-389c-b43b-828999a7ca5f","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review.","datePublished":"Oct 7, 2026, 5:48:03 PM","dateUpdated":"Oct 10, 2026, 2:38:31 AM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f\nhttps://github.com/qax-os/excelize/pull/2396\nhttps://github.com/qax-os/excelize/commit/5f636f9dcde55911f14290060b017f0cc88cd694\n","aliases":"CVE-2026-107215\nGHSA-x2q3-8cjh-766f\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"ac58f80b-6e7d-3064-bcbd-7d778f688a3f","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"2.3.1, ≤ 2.11.0"}],"enisaIdVendor":[{"id":"17ccdf0b-80cd-380c-9eb3-50c53e2d6f19","vendor":{"name":"qax-os"}}],"enisaIdVulnerability":[{"id":"167c27a7-98a0-39ee-8466-9968cccacd87","vulnerability":{"id":"CVE-2026-107215","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review.","datePublished":"Oct 7, 2026, 5:48:03 PM","dateUpdated":"Oct 10, 2026, 2:38:31 AM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f\nhttps://github.com/qax-os/excelize/pull/2396\nhttps://github.com/qax-os/excelize/commit/5f636f9dcde55911f14290060b017f0cc88cd694\n","enisa_id":"EUVD-2026-94533\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Oct 29, 2026, 7:16:26 AM","vulnerabilityProduct":[{"id":"d9532c1d-2b34-3467-ad43-020b1e34c0bd","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"2.3.1, ≤ 2.11.0"}],"vulnerabilityVendor":[{"id":"f4a2b6ed-3b78-3fe4-89f6-80a506a2e982","vendor":{"name":"qax-os"}}]}},{"id":"67dd3886-1b9d-3060-93c7-bec9eb66a818","vulnerability":{"id":"GHSA-x2q3-8cjh-766f","description":"Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS","datePublished":"Oct 8, 2026, 4:31:26 PM","dateUpdated":"Oct 8, 2026, 4:31:26 PM","baseScore":0.0,"references":"https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107215\nhttps://github.com/qax-os/excelize/pull/2396\nhttps://github.com/qax-os/excelize/commit/5f636f9dcde55911f14290060b017f0cc88cd694\nhttps://github.com/qax-os/excelize\n","enisa_id":"EUVD-2026-94533\n","aliases":"CVE-2026-107215\nGHSA-x2q3-8cjh-766f\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}