Is CVE-2026-107215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107215 being exploited in the wild.

How severe is CVE-2026-107215?

High severity, with a CVSS score of 7.5, published 8 October 2026.

Which products and versions are affected?

github.com/360EntSecGroup-Skylar/excelize/v2 (Go) SEMVER:introduced=2.3.1; github.com/xuri/excelize/v2 (Go) >= 2.3.1, < 2.11.1-0.20260912113515-5f636f9dcde5, SEMVER:introduced=0,fixed=2.11.1-0.20260912113515-5f636f9dcde5, SEMVER:introduced=2.3.1,fixed=2.11.1-0.20260912113515-5f636f9dcde5; Xuri Excelize prior to fix (advisory does not specify fixed version).

How is CVE-2026-107215 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107215?

Check whether you run github.com/360EntSecGroup-Skylar/excelize/v2 (Go), github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107215: Excelize extractPart unbounded buffer allocation DoS

Q: Is there a fix for CVE-2026-107215?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260912113515-5f636f9dcde5 or later. Until then: Apply the proposed patch to bound declared stream sizes before allocation in extractPart, rejecting negative or oversized entries (above 1 GiB) as format errors rather than allocating. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107215 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107215?

Check whether you run github.com/360EntSecGroup-Skylar/excelize/v2 (Go), github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107215 · Severity: high · CVSS 7.5 · Published 2026-10-08

Excelize is a Go library for reading and writing spreadsheet files. An attacker can upload a specially crafted Office file to a service using Excelize, triggering either an immediate process crash or forcing massive memory allocation (up to 4 GB per file), causing denial of service in memory-limited environments.

Technologies: github.com/360EntSecGroup-Skylar/excelize/v2 (Go), github.com/xuri/excelize/v2 (Go), Xuri Excelize. Vendors: Go, Xuri.

Quick answers

Is CVE-2026-107215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107215 being exploited in the wild.
How severe is CVE-2026-107215?: High severity, with a CVSS score of 7.5, published 8 October 2026.
Which products and versions are affected?: github.com/360EntSecGroup-Skylar/excelize/v2 (Go) SEMVER:introduced=2.3.1; github.com/xuri/excelize/v2 (Go) >= 2.3.1, < 2.11.1-0.20260912113515-5f636f9dcde5, SEMVER:introduced=0,fixed=2.11.1-0.20260912113515-5f636f9dcde5, SEMVER:introduced=2.3.1,fixed=2.11.1-0.20260912113515-5f636f9dcde5; Xuri Excelize prior to fix (advisory does not specify fixed version).
Is there a fix for CVE-2026-107215?: Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260912113515-5f636f9dcde5 or later. Until then: Apply the proposed patch to bound declared stream sizes before allocation in extractPart, rejecting negative or oversized entries (above 1 GiB) as format errors rather than allocating. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107215 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107215?: Check whether you run github.com/360EntSecGroup-Skylar/excelize/v2 (Go), github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260912113515-5f636f9dcde5 or later
```
go get github.com/xuri/excelize/v2@v2.11.1-0.20260912113515-5f636f9dcde5
```

Apply the proposed patch to bound declared stream sizes before allocation in extractPart, rejecting negative or oversized entries (above 1 GiB) as format errors rather than allocating.

Technical details

The extractPart function in crypt.go allocates a buffer directly from an attacker-controlled stream size field in the CFB (Compound File Binary) directory entry without validation or bounds checking. This allows attackers to specify negative sizes (causing panic) or very large sizes (causing OOM), with amplification factors up to 350,000× from a ~12 KB file. The vulnerability exists in the OLE file decryption path triggered by OpenFile/OpenReader/OpenBytes.

Affected products

xuri Excelize prior to fix (advisory does not specify fixed version)

Identifiers

CVE-2026-107215
GHSA-x2q3-8cjh-766f
GO-2026-6689

Timeline

2026-10-08: disclosed: GHSA-x2q3-8cjh-766f published
2026-10-08: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.