IT SBIT Services
Schneeberger
DEEN
CVE tracker

Excelize: Denial of service through unchecked pivot-cache field index

CVE-2026-107211High 8.7

← All vulnerabilities

Summary

Excelize, a Go library for reading and writing Excel files, does not check pivot-table field indices before using them to index the pivot-cache field list. A crafted .xlsx workbook with a pivot-field count mismatch or an out-of-range dataField fld value causes an unrecovered Go slice-bounds panic when GetPivotTables is called. The panic terminates the host process or worker, so an attacker can cause a denial of service by supplying a single malicious file, with no authentication required. Only availability is affected.

Affected

  • Excelize (Go module github.com/xuri/excelize/v2) versions 2.8.1 through 2.11.0
  • Applications that open untrusted .xlsx files containing pivot tables and call File.GetPivotTables

Fixed in

  • No tagged release with the fix is known as of this review.
  • The fix is in upstream commit 6258dcebc4e2a2aed985c38a08098dfd908521d1 (2026-10-03) on the master branch.
  • The advisory lists no patched version, so the commit should be treated as a development snapshot until a release is published.

Workaround

  • Do not pass untrusted .xlsx files to GetPivotTables until the library is upgraded.
  • Validate pivot-table field counts and dataField indices before the workbook reaches Excelize.
  • Run parsing of untrusted files in a separate process or container that restarts on failure, which limits the impact to that worker.
  • Do not rely on recover() to catch this panic, because the advisory describes it as unrecoverable.

Exploitation

  • CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
  • The advisory author reproduced the crash with malformed workbooks. No exploitation in the wild is known.
  • The Known Exploited Vulnerabilities catalogue was not checked as part of this review.

Our recommendation

  • Identify applications that depend on github.com/xuri/excelize/v2 in the range 2.8.1 to 2.11.0, using SBOMs or dependency lists.
  • Prioritise services that accept spreadsheets from customers, suppliers or other external parties.
  • Restrict or isolate spreadsheet parsing of untrusted files until a fixed release is available, and test the upstream fix commit before deploying it.
  • Configure automatic restart of worker processes and monitor for repeated panics in logs.
  • Watch the GitHub advisory GHSA-mx22-3794-2vpv for a tagged release and upgrade once it is published.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:24.

Original description (NVD)

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while processing GetPivotTables and trusts the dataField fld attribute as an index. When a crafted workbook supplies a pivot-field count mismatch or an out-of-range dataField fld value before GetPivotTables is called, the unchecked index causes a Go slice-bounds panic that escapes the library, allowing an attacker to crash the process or request worker. No fixed version is available as of this review.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed