CVE-2026-107222 in Excelize
Summary
by MITRE • 10/07/2026
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in the Excelize library affects versions ranging from 2.7.0 through 2.11.0, representing a critical flaw in how the Go-based spreadsheet processing tool handles conditional formatting rules within Microsoft Excel files. As a widely used utility for reading and writing XLSX formats, Excelize is frequently integrated into backend services that process user-uploaded documents or parse external data sources containing spreadsheets. The core issue lies in the insufficient validation of XML structure when extracting conditional format definitions. Specifically, the function GetConditionalFormats invokes internal extraction routines such as extractCondFmtCellIs and directly accesses nested properties like ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without performing rigorous structural checks to ensure these elements exist or are properly formed before access.
This lack of validation creates a scenario where malformed XML structures can trigger runtime errors in the Go application. When an attacker crafts a malicious Excel file containing conditional formatting rules that omit expected child nodes—such as missing formula references, absent color values, or incomplete value objects—the library attempts to dereference nil pointers or index into empty slices. In Go, such operations result in a panic rather than returning a graceful error code. Because many server-side applications do not implement comprehensive recovery mechanisms for panics originating from third-party libraries, this flaw allows an attacker to cause the application process to terminate abruptly. This constitutes a classic denial of service vulnerability where resource availability is compromised through simple file upload or processing actions.
From a technical classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-476 NULL Pointer Dereference. The failure to verify that required XML elements are present before accessing them violates the principle of defensive programming, which mandates that all external inputs be validated against expected schemas prior to processing. Furthermore, in the context of attack vectors, this vulnerability maps to ATT&CK technique T1499 Endpoint Denial of Service via application crash or hang. The impact is particularly severe because it does not require authentication if the service processes uploaded files automatically, nor does it necessarily expose sensitive data directly, but rather disrupts operational continuity by crashing the host process.
Mitigation strategies for this vulnerability are currently limited due to the absence of a patched version as noted in the review. Organizations relying on Excelize must implement application-level safeguards to mitigate the risk. This includes wrapping calls to GetConditionalFormats and related extraction functions within recover blocks that catch panics, thereby preventing the crash from propagating to the main process loop. Additionally, input validation should be enforced at the ingestion layer by validating uploaded XLSX files against a strict schema before they are passed to the Excelize library for parsing. Implementing timeouts and resource limits on file processing can also help contain the blast radius of such attacks until an official patch is released by the maintainers.