CVE-2026-107212: CPU Exhaustion Denial of Service via Look-Ahead Row Parsing in Excelize

Vulnerability ID: CVE-2026-107212
CVSS Score: 7.5
Published: 2026-10-08

An algorithmic complexity vulnerability (CWE-770) in the Excelize library allows remote attackers to cause resource exhaustion (100% CPU usage) via a crafted Microsoft Excel spreadsheet. This occurs because the look-ahead row index parsing in Rows.Columns() fails to enforce upper boundary limits, enabling an out-of-bounds row index to trigger an infinite seek loop inside the Rows iterator.

TL;DR

A vulnerability in Excelize allows unauthenticated remote attackers to trigger a sustained Denial of Service (100% CPU exhaustion) by uploading an Excel file containing a row index that exceeds the platform's architectural maximum.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.5 (High)
  • EPSS Score: 0.00339 (Percentile: 25.26%)
  • Impact: Denial of Service (CPU Exhaustion)
  • Exploit Status: PoC / Tested
  • CISA KEV Status: Not Listed

Affected Systems

  • github.com/xuri/excelize
  • github.com/qax-os/excelize
  • excelize: >= 2.1.0, <= 2.11.0 (Fixed in: Commit 01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23)

Code Analysis

Commit: 01a9ff3

Enforce row limit validation in look-ahead parser to resolve unbounded loop execution

Mitigation Strategies

  • Update Excelize dependency to a patched version or commit hash
  • Implement context-based execution timeouts on parsing routines
  • Configure strict container-level CPU quotas to prevent host-wide starvation
  • Reject spreadsheet uploads containing abnormal metadata via perimeter inspection

Remediation Steps:

  1. Open the project's go.mod file
  2. Update the github.com/xuri/excelize/v2 dependency to commit 01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23 or newer
  3. Run 'go mod tidy' to update the dependency tree
  4. Recompile the application and redeploy to staging environments
  5. Run verification tests with crafted out-of-bounds spreadsheet files

References

Read the full report for CVE-2026-107212 on our website for more details including interactive diagrams and full exploit analysis.