Medium severity · published Oct 7, 2026
CVE-2026-107222
Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
excelize · qax-os
>= 2.7.0, <= 2.11.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107222
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107222
x_refsource_CONFIRM
https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr
x_refsource_MISC
https://github.com/qax-os/excelize/pull/2375
x_refsource_MISC
https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd
More from excelize
7.5
CVE-2026-107223
Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
7.5
CVE-2026-107219
Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
7.5
CVE-2026-107217
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
7.5
CVE-2026-107216
Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
7.5
CVE-2026-107215
Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS