CVE-2026-107224 Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader
An attacker can cause a denial of service by crafting an Excel file with a specific Zip64 size that triggers a panic in the Excelize library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-107224?
CVE-2026-107224 is a medium-severity vulnerability in qax-os excelize, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.
Which versions are affected by CVE-2026-107224?
2 open source packages ship an affected version, including github.com/xuri/excelize/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/xuri/excelize/v2 Go | From 2.1.0 | 2.11.1-0.20260805032953-db93f8d89de7 |
github.com/xuri/excelize/v2 Go | From 2.1.0 | 2.11.1-0.20260805032953-db93f8d89de7 |
Products include Excelize Excelize.
How do I fix CVE-2026-107224?
Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260805032953-db93f8d89de7 or later.
Is CVE-2026-107224 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107224 exists.
Other vulnerabilities in qax-os excelize
- CVE-2026-107211 Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
- CVE-2026-107213 Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
- CVE-2026-59161 Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
- CVE-2026-107212 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
- CVE-2026-107214 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
Sources
Also known as GHSA-fw94-4wwp-w8pw.