CVE-2026-107225: excelize Improper Input Validation

Vulnerability summary

CVE-2026-107225 is a medium (CVSS 6.5) Improper Input Validation vulnerability in excelize. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-10-2026
   PublishedVulnerability first disclosed.
2. 10-10-2026
   Last modifiedVulnerability information updated.

Description

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.