{"id":"EUVD-2026-94548","revision":null,"records":[{"revision":"63d763b8516c4adcadf421b4c8ffa8ef","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107218","aliases":[],"title":"Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review.","state":0,"publishedAt":"2026-10-07T18:29:38.606+00:00","modifiedAt":"2026-10-07T22:05:36.155+00:00","affected":[{"ecosystem":"Vendor product","name":"excelize","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"qax-os\",\n                    \"product\": \"excelize\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.10.1, <= 2.11.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6","https://github.com/qax-os/excelize/pull/2390","https://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107218","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107218","identifiers":["CVE-2026-107218"]},"retained":false,"historicalAffected":[]},{"revision":"4d2870a1143a4fc9a78b66286d165fe8","observedAt":"2026-11-09T13:16:36.143+00:00","statement":{"source":"euvd","id":"EUVD-2026-94548","aliases":["CVE-2026-107218","GHSA-8jjq-8j9w-m2v6"],"title":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT …","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6","https://github.com/qax-os/excelize/pull/2390","https://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94548","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 7, 2026, 6:29:38 PM","dateUpdated":"Oct 7, 2026, 10:05:36 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-94548","identifiers":["EUVD-2026-94548","CVE-2026-107218","GHSA-8jjq-8j9w-m2v6"]},"retained":false,"historicalAffected":[]},{"revision":"f824f7a6d53341f3af2a81657c4eeace","observedAt":"2026-10-25T04:17:41.466+00:00","statement":{"source":"nvd","id":"CVE-2026-107218","aliases":[],"title":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT …","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review.","state":0,"publishedAt":"2026-10-07T19:17:34.12+00:00","modifiedAt":"2026-10-13T14:23:29.317+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396","https://github.com/qax-os/excelize/pull/2390","https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107218","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-129"],"productCriteria":["cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:*"],"sourceDates":{"published":"2026-10-07T19:17:34.120","lastModified":"2026-10-13T14:23:29.317"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-107218","identifiers":["CVE-2026-107218"]},"retained":false,"historicalAffected":[]},{"revision":"c200d77743444962a4e461ce302437bd","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GHSA-8jjq-8j9w-m2v6","aliases":["CVE-2026-107218","GO-2026-6675"],"title":"Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics","description":"`leftRight` (calc.go:14236) tests the length with `countUTF16String`, which counts a rune above U+FFFF as 2. The RIGHT branch on 14241 then slices `[]rune(text)` at `utf8.RuneCountInString(text)-numChars`, which counts it as 1. For text with N such runes the two measures are 2N and N, so any `numChars` between them passes the guard and gives a negative index. The `numChars < 0` check at 14216 does not help, since the value that gets through is positive.\n\nWhat makes it worth reporting is `AutoFitColWidth`, which evaluates formulas without looking like it does, so normalising an uploaded sheet is enough to reach it. One scoping correction to my own wording there: `AutoFitColWidth` was added in v2.11.0 and does not exist at v2.10.1, so on v2.10.1 the only reachable path is an explicit `CalcCellValue`.\n\nA 6,077-byte file containing two U+1D7D9 characters in A1 and \u00A0RIGHT(A1,3)\u00A0 in B1 was created and then opened in a separate program without recovery enabled:\n\n```\nv2.9.1    ok\nv2.10.0   ok\nv2.10.1   panic: slice bounds out of range [-1:]\nv2.11.0   panic: slice bounds out of range [-1:]\n```\n\nSo it is a regression, not an old defect. Commit a880146 (2026-01-16) moved the guard to `countUTF16String` and left the slice on the rune index, and `git tag --contains` gives v2.10.1 and v2.11.0 only.\n\nRIGHT only. RIGHTB reaches the same function but takes the byte branch at 14225, which is internally consistent, and I probed MID and MIDB from 1 to 5 with no panic. It is the same negative-index family as GHSA-fx5j-qcqg-grpf and GHSA-48hm-4h8j-58fg, though those are shared-string lookups in the reader rather than a unit mismatch in the formula library.","state":0,"publishedAt":"2026-10-07T20:23:26+00:00","modifiedAt":"2026-11-05T23:26:05.8172517+00:00","affected":[{"ecosystem":"Go","name":"github.com/xuri/excelize/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.10.1"},{"kind":"fixed","version":"2.11.1-0.20260908032718-ecd99d761fe0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6","https://github.com/qax-os/excelize/pull/2390","https://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396","https://github.com/qax-os/excelize"],"sourceUrl":"https://github.com/advisories/GHSA-8jjq-8j9w-m2v6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8jjq-8j9w-m2v6","identifiers":["GHSA-8jjq-8j9w-m2v6","CVE-2026-107218","GO-2026-6675"]},"retained":false,"historicalAffected":[]},{"revision":"f20f6f179a1c4cf3a59ff0b16b477633","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6675","aliases":["CVE-2026-107218","GHSA-8jjq-8j9w-m2v6"],"title":"Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics in github.com/xuri/excelize","description":"Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics in github.com/xuri/excelize","state":0,"publishedAt":"2026-11-05T22:53:46+00:00","modifiedAt":"2026-11-05T23:15:11.894048+00:00","affected":[{"ecosystem":"Go","name":"github.com/xuri/excelize/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.10.1"},{"kind":"fixed","version":"2.11.1-0.20260908032718-ecd99d761fe0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6","https://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396","https://github.com/qax-os/excelize/pull/2390"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6675","license":"OSV · upstream source license applies","key":"osv:GO-2026-6675","identifiers":["GO-2026-6675","CVE-2026-107218","GHSA-8jjq-8j9w-m2v6"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T08:21:42.9806814+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T08:21:42.9806814+00:00","lastSuccessAt":"2026-11-10T08:21:49.9716687+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:49.9722477+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-746bb7faca3153abeb3c809473890793eb06eef475a9980d578ad522a2f91b4d","complete":true,"records":421910,"lastAttemptAt":"2026-11-10T08:21:35.2839989+00:00","lastSuccessAt":"2026-11-10T08:02:16.532381+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:35.2839989+00:00","snapshotPublishedAt":"2026-11-10T07:28:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T08:22:41.0210911+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T08:21:42.9806814+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T08:21:42.9806814+00:00","lastSuccessAt":"2026-11-10T08:22:06.2444793+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:22:06.2444805+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-78b08a98b3ce49f188246fb2aae3c44d","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T08:22:40.320966+00:00","lastSuccessAt":"2026-11-10T08:22:40.318+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T08:22:40.318+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T08:21:42.331385+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:42.331385+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T08:21:38.6986948+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:38.6986948+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T08:21:42.4406049+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:42.4406049+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T08:21:40.047287+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:40.047287+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}