{"id":"EUVD-2026-94548","enisaUuid":"b0681d65-3fb5-31e4-abb6-a95b34f9f8f8","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review.","datePublished":"Oct 7, 2026, 6:29:38 PM","dateUpdated":"Oct 7, 2026, 10:05:36 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6\nhttps://github.com/qax-os/excelize/pull/2390\nhttps://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396\n","aliases":"CVE-2026-107218\nGHSA-8jjq-8j9w-m2v6\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"d470a8c5-95ae-3dcf-a23a-657fb9377c1f","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"2.10.1, ≤ 2.11.0"}],"enisaIdVendor":[{"id":"1a783f11-01d3-3698-94d6-5298d0bea454","vendor":{"name":"qax-os"}}],"enisaIdVulnerability":[{"id":"2eb2b3c8-fdb8-3d77-aade-c2f3daaac36d","vulnerability":{"id":"GHSA-8jjq-8j9w-m2v6","description":"Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics","datePublished":"Oct 7, 2026, 8:23:26 PM","dateUpdated":"Oct 7, 2026, 8:23:27 PM","baseScore":0.0,"references":"https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6\nhttps://github.com/qax-os/excelize/pull/2390\nhttps://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396\nhttps://github.com/qax-os/excelize\n","enisa_id":"EUVD-2026-94548\n","aliases":"GHSA-8jjq-8j9w-m2v6\nCVE-2026-107218\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"546c95fd-1b53-3b47-a9d6-86913747d856","vulnerability":{"id":"CVE-2026-107218","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review.","datePublished":"Oct 7, 2026, 6:29:38 PM","dateUpdated":"Oct 7, 2026, 10:05:36 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6\nhttps://github.com/qax-os/excelize/pull/2390\nhttps://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396\n","enisa_id":"EUVD-2026-94548\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 7, 2026, 7:20:27 AM","vulnerabilityProduct":[{"id":"170dcd76-283f-3db4-8c46-10776cee18bd","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"2.10.1, ≤ 2.11.0"}],"vulnerabilityVendor":[{"id":"7d7f1018-afa4-3433-a39f-e7a71400875e","vendor":{"name":"qax-os"}}]}}],"enisaIdAdvisory":[]}