CVE-2026-107225

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.

• CWE-20
• CWE-129

• https://github.com/qax-os/excelize/commit/ae2113b410e51f6a141c396a59eda8c42b91bc22
• https://github.com/qax-os/excelize/pull/2367
• https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10722A vulnerability has been found in cilium ebpf up to 0.21.0. …5.5
• CVE-2026-107220Excelize is a Go language library for reading and writing Mi…6.5
• CVE-2026-107221Excelize is a Go language library for reading and writing Mi…6.5
• CVE-2026-107222Excelize is a Go language library for reading and writing Mi…6.5
• CVE-2026-107223Excelize is a Go language library for reading and writing Mi…7.1
• CVE-2026-107224Excelize is a Go language library for reading and writing Mi…6.5
• CVE-2026-10723BIND may accept incorrect child-zone NSEC3 records as valid,…6.8
• CVE-2026-10724The Reviews Feed WordPress plugin before 2.6.5 does not neu…4.8
• CVE-2026-10725Protocol::HTTP2 versions before 1.13 for Perl is vulnerable …7.5
• CVE-2026-10726Cato Windows SDP Client before version 6.12.6 contains an ar…6.8
• CVE-2026-107269Gophish through 0.12.1 contains a timing discrepancy vulnera…3.7
• CVE-2026-10727An OS command injection vulnerability in Ivanti EPMM before …7.2