Excelize: Nil pointer dereference in GetSlicers
Summary
Excelize, a Go library for reading and writing Microsoft Excel files, dereferences a nil pointer in GetSlicers when a worksheet contains an extLst element but no drawing element. An attacker can craft an XLSX file that crashes an application when it calls GetSlicers on that file. The documented impact is limited to availability (denial of service). Exploitation requires an application that processes untrusted spreadsheets with this function.
Affected
- Go module github.com/xuri/excelize/v2, versions >= 2.9.0 through 2.11.0
Fixed in
- Commit 8ffeb07ec9a350410f6922313f6b7e4f5cc79241 (PR #2434) adds the missing nil check. No tagged release containing the fix was confirmed. The CVE record states that no fixed version is available as of the review.
Workaround
- Do not call GetSlicers on untrusted files if slicer data is not needed.
- Wrap GetSlicers calls in panic recovery (defer/recover) where the application supports it.
- Process uploaded spreadsheets in isolated workers so that a crash does not affect other services.
Exploitation
- Public proof of concept: the GitHub advisory describes a reproduction with an empty extLst element.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Not listed as known exploited; EPSS is low.
Our recommendation
- Check whether any application uses the excelize module and calls GetSlicers on uploaded or external files.
- Update to a commit at or after 8ffeb07 while no tagged release is available, and test the build.
- Isolate spreadsheet processing and monitor for crashes or restarts of affected services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-r7x5-4969-99p7 github.com
- Fix commit 8ffeb07 in qax-os/excelize github.com
- Pull request #2434 in qax-os/excelize github.com
- OSV entry GHSA-r7x5-4969-99p7 osv.dev
- Tenable CVE-2026-107213 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:25.
Original description (NVD)
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. File.GetSlicers reads ws.Drawing.RID after seeing a worksheet extLst element even when the independently optional worksheet drawing element is absent. When a crafted worksheet contains an extLst element without a drawing element and the application calls GetSlicers, the nil ws.Drawing pointer is dereferenced while resolving the drawing relationship, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.