{"id":"EUVD-2026-94555","enisaUuid":"516f1361-c71d-3f9b-8758-ca3fef1e49bc","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.","datePublished":"Oct 7, 2026, 6:53:27 PM","dateUpdated":"Oct 7, 2026, 7:30:13 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw\nhttps://github.com/qax-os/excelize/pull/2369\nhttps://github.com/qax-os/excelize/commit/db93f8d89de71589069a54d1b998af02e3c5f7cd\n","aliases":"CVE-2026-107224\nGHSA-fw94-4wwp-w8pw\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"a4c21b6f-30ef-34a6-8a75-3bbc6b07c83a","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"2.1.0, ≤ 2.11.0"}],"enisaIdVendor":[{"id":"89281c1e-5f54-30b0-9bd2-c76d2462168c","vendor":{"name":"qax-os"}}],"enisaIdVulnerability":[{"id":"bea8fa06-eae0-3bef-a298-04df05e3508f","vulnerability":{"id":"GHSA-fw94-4wwp-w8pw","description":"Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader","datePublished":"Oct 7, 2026, 8:22:45 PM","dateUpdated":"Oct 7, 2026, 8:22:45 PM","baseScore":0.0,"references":"https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw\nhttps://github.com/qax-os/excelize/pull/2369\nhttps://github.com/qax-os/excelize/commit/db93f8d89de71589069a54d1b998af02e3c5f7cd\nhttps://github.com/qax-os/excelize\n","enisa_id":"EUVD-2026-94555\n","aliases":"CVE-2026-107224\nGHSA-fw94-4wwp-w8pw\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f17b783b-d422-3cf2-98b4-b92e639b2a4f","vulnerability":{"id":"CVE-2026-107224","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.","datePublished":"Oct 7, 2026, 6:53:27 PM","dateUpdated":"Oct 7, 2026, 7:30:13 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-fw94-4wwp-w8pw\nhttps://github.com/qax-os/excelize/pull/2369\nhttps://github.com/qax-os/excelize/commit/db93f8d89de71589069a54d1b998af02e3c5f7cd\n","enisa_id":"EUVD-2026-94555\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 2, 2026, 7:17:18 AM","vulnerabilityProduct":[{"id":"f0d57e27-aa29-355b-a9c1-3350b49705af","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"2.1.0, ≤ 2.11.0"}],"vulnerabilityVendor":[{"id":"09d99fbc-c053-3f81-8b80-44bc6151b7f4","vendor":{"name":"qax-os"}}]}}],"enisaIdAdvisory":[]}