# CVE-2026-107215: Excelize extractPart unbounded buffer allocation DoS

Source: https://junglewise.ai/threats/cve-2026-107215-excelize-extractpart-allocates-attacker-controlled-unbounded-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107215 · Severity: high · CVSS 7.5 · Published 2026-10-08

Excelize is a Go library for reading and writing spreadsheet files. An attacker can upload a specially crafted Office file to a service using Excelize, triggering either an immediate process crash or forcing massive memory allocation (up to 4 GB per file), causing denial of service in memory-limited environments.

Technologies: [github.com/360EntSecGroup-Skylar/excelize/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-360entsecgroup-skylar-excelize-v2), [github.com/xuri/excelize/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-xuri-excelize-v2), [Xuri Excelize](https://junglewise.ai/threats/technologies/excelize). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Xuri](https://junglewise.ai/threats/vendors/xuri).

## Quick answers

**Is CVE-2026-107215 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107215 being exploited in the wild.

**How severe is CVE-2026-107215?** High severity, with a CVSS score of 7.5, published 8 October 2026.

**Which products and versions are affected?** github.com/360EntSecGroup-Skylar/excelize/v2 (Go) SEMVER:introduced=2.3.1; github.com/xuri/excelize/v2 (Go) >= 2.3.1, < 2.11.1-0.20260912113515-5f636f9dcde5, SEMVER:introduced=0,fixed=2.11.1-0.20260912113515-5f636f9dcde5, SEMVER:introduced=2.3.1,fixed=2.11.1-0.20260912113515-5f636f9dcde5; Xuri Excelize prior to fix (advisory does not specify fixed version).

**Is there a fix for CVE-2026-107215?** Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260912113515-5f636f9dcde5 or later. Until then: Apply the proposed patch to bound declared stream sizes before allocation in extractPart, rejecting negative or oversized entries (above 1 GiB) as format errors rather than allocating. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107215 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107215?** Check whether you run github.com/360EntSecGroup-Skylar/excelize/v2 (Go), github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260912113515-5f636f9dcde5 or later

  ```sh
  go get github.com/xuri/excelize/v2@v2.11.1-0.20260912113515-5f636f9dcde5
  ```


Apply the proposed patch to bound declared stream sizes before allocation in extractPart, rejecting negative or oversized entries (above 1 GiB) as format errors rather than allocating.

## Technical details

The extractPart function in crypt.go allocates a buffer directly from an attacker-controlled stream size field in the CFB (Compound File Binary) directory entry without validation or bounds checking. This allows attackers to specify negative sizes (causing panic) or very large sizes (causing OOM), with amplification factors up to 350,000× from a ~12 KB file. The vulnerability exists in the OLE file decryption path triggered by OpenFile/OpenReader/OpenBytes.

## Affected products

- xuri Excelize prior to fix (advisory does not specify fixed version)

## Identifiers

- CVE-2026-107215
- GHSA-x2q3-8cjh-766f
- GO-2026-6689

## Timeline

- 2026-10-08: disclosed: GHSA-x2q3-8cjh-766f published
- 2026-10-08: advisory

## Related threats

- [Excelize unchecked pivot-cache field index bounds in extractPivotTableFields](https://junglewise.ai/threats/cve-2026-107211-excelize-unchecked-pivot-cache-field-index-in)
- [Excelize unbounded row iteration denial of service](https://junglewise.ai/threats/cve-2026-107212-excelize-unbounded-row-number-in-rows-columns-makes-getrows-and)
- [Excelize nil-pointer dereference in GetSlicers](https://junglewise.ai/threats/cve-2026-107213-excelize-nil-pointer-dereference-in-getslicers-when-a-worksheet)
- [Excelize Decrypt panic on malformed OLE encrypted workbooks](https://junglewise.ai/threats/cve-2026-107214-excelize-decrypt-unrecoverable-panics-on-malformed-ole-cfb)
- [Excelize ANCHORARRAY mutually-referencing formulas stack overflow](https://junglewise.ai/threats/cve-2026-107216-excelize-anchorarray-mutually-referencing-array-formulas-recurse)