{"id":"EUVD-2026-94556","enisaUuid":"5af868f4-b4c3-3ddc-9149-760522813b54","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle\u0027s fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.","datePublished":"Oct 7, 2026, 6:55:55 PM","dateUpdated":"Oct 10, 2026, 2:42:21 AM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65\nhttps://github.com/qax-os/excelize/pull/2367\nhttps://github.com/qax-os/excelize/commit/ae2113b410e51f6a141c396a59eda8c42b91bc22\n","aliases":"CVE-2026-107225\nGHSA-5h23-36rv-pm65\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"e8741b55-bc56-3098-937b-d18b0121aacc","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"2.8.0, ≤ 2.11.0"}],"enisaIdVendor":[{"id":"376bbabd-005d-395c-902d-a5a70e1210c7","vendor":{"name":"qax-os"}}],"enisaIdVulnerability":[{"id":"26fd3354-088c-3b3b-85aa-cdde8d196b8d","vulnerability":{"id":"CVE-2026-107225","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle\u0027s fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.","datePublished":"Oct 7, 2026, 6:55:55 PM","dateUpdated":"Oct 10, 2026, 2:42:21 AM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65\nhttps://github.com/qax-os/excelize/pull/2367\nhttps://github.com/qax-os/excelize/commit/ae2113b410e51f6a141c396a59eda8c42b91bc22\n","enisa_id":"EUVD-2026-94556\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Nov 8, 2026, 7:16:38 AM","vulnerabilityProduct":[{"id":"a0b52566-a24a-3c79-92ee-4338cecc015b","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"2.8.0, ≤ 2.11.0"}],"vulnerabilityVendor":[{"id":"df7dd0b5-9127-36fb-a2dc-7709279dfdc7","vendor":{"name":"qax-os"}}]}},{"id":"d712d5ce-1474-3b6e-a8d6-2beb8c84ef79","vulnerability":{"id":"GHSA-5h23-36rv-pm65","description":"Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml","datePublished":"Oct 7, 2026, 8:22:39 PM","dateUpdated":"Oct 7, 2026, 8:22:39 PM","baseScore":0.0,"references":"https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65\nhttps://github.com/qax-os/excelize/pull/2367\nhttps://github.com/qax-os/excelize/commit/ae2113b410e51f6a141c396a59eda8c42b91bc22\nhttps://github.com/qax-os/excelize\n","enisa_id":"EUVD-2026-94556\n","aliases":"CVE-2026-107225\nGHSA-5h23-36rv-pm65\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}