Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-59161 · Microsoft / collected KEV context

EUVD-2026-42936

GHSA-q5j5-6p94-4gwc

GO-2026-6453

cve-program · CVE-2026-59161

• https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc
• https://github.com/qax-os/excelize/pull/2331
• https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453
• https://github.com/qax-os/excelize/releases/tag/v2.11.0

euvd · EUVD-2026-42936

• https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc
• https://github.com/qax-os/excelize/pull/2331
• https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453
• https://github.com/qax-os/excelize/releases/tag/v2.11.0

nvd · CVE-2026-59161

• https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453
• https://github.com/qax-os/excelize/pull/2331
• https://github.com/qax-os/excelize/releases/tag/v2.11.0
• https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc

osv · GHSA-q5j5-6p94-4gwc

• https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc
• https://nvd.nist.gov/vuln/detail/CVE-2026-59161
• https://github.com/qax-os/excelize/pull/2331
• https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453
• https://github.com/qax-os/excelize
• https://github.com/qax-os/excelize/releases/tag/v2.11.0

osv · GO-2026-6453

• https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc
• https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453
• https://github.com/qax-os/excelize/pull/2331
• https://github.com/qax-os/excelize/releases/tag/v2.11.0

No related operational record is retained in the current change model.