Is CVE-2026-107217 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107217 being exploited in the wild.

How severe is CVE-2026-107217?

High severity, with a CVSS score of 7.5, published 7 October 2026.

Which products and versions are affected?

github.com/xuri/excelize (Go) >= 1.1.0, = 2.0.0, < 2.11.1-0.20260910071107-696050fbf14e, SEMVER:introduced=0,fixed=2.11.1-0.20260910071107-696050fbf14e, SEMVER:introduced=2.0.0,fixed=2.11.1-0.20260910071107-696050fbf14e; Xuri Excelize versions prior to patch.

How is CVE-2026-107217 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107217?

Check whether you run github.com/xuri/excelize (Go), github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107217: Excelize ColumnNameToNumber integer overflow causing panic

Q: Is there a fix for CVE-2026-107217?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260910071107-696050fbf14e or later. Until then: Validate and sanitize spreadsheet files before processing, or restrict spreadsheet file uploads to trusted sources until a patched version is deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107217 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107217?

Check whether you run github.com/xuri/excelize (Go), github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107217 · Severity: high · CVSS 7.5 · Published 2026-10-07

Excelize is a Go library for reading and writing Excel spreadsheets. A crafted spreadsheet file with a specially constructed column name can cause integer overflow, leading to an out-of-bounds array access that crashes the application. Any service that opens user-supplied .xlsx files—such as mail scanners, document converters, or upload processors—can be taken offline by an attacker uploading a malicious file.

Technologies: github.com/xuri/excelize (Go), github.com/xuri/excelize/v2 (Go), Xuri Excelize. Vendors: Go, Xuri.

Quick answers

Is CVE-2026-107217 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107217 being exploited in the wild.
How severe is CVE-2026-107217?: High severity, with a CVSS score of 7.5, published 7 October 2026.
Which products and versions are affected?: github.com/xuri/excelize (Go) >= 1.1.0, <= 1.4.1, SEMVER:introduced=1.1.0, SEMVER:introduced=1.1.0,last_affected=1.4.1; github.com/xuri/excelize/v2 (Go) >= 2.0.0, < 2.11.1-0.20260910071107-696050fbf14e, SEMVER:introduced=0,fixed=2.11.1-0.20260910071107-696050fbf14e, SEMVER:introduced=2.0.0,fixed=2.11.1-0.20260910071107-696050fbf14e; Xuri Excelize versions prior to patch.
Is there a fix for CVE-2026-107217?: Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260910071107-696050fbf14e or later. Until then: Validate and sanitize spreadsheet files before processing, or restrict spreadsheet file uploads to trusted sources until a patched version is deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107217 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107217?: Check whether you run github.com/xuri/excelize (Go), github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260910071107-696050fbf14e or later
```
go get github.com/xuri/excelize/v2@v2.11.1-0.20260910071107-696050fbf14e
```

Validate and sanitize spreadsheet files before processing, or restrict spreadsheet file uploads to trusted sources until a patched version is deployed.

Technical details

The ColumnNameToNumber function accumulates a bijective base-26 value in an int64 without overflow detection; a 14-letter column name whose true value is 3·2⁶⁴ wraps to zero and bypasses the upper-bound check, causing CellNameToCoordinates to return col=0 with nil error. Subsequent code subtracts 1 (colIdx := col - 1) yielding -1, which triggers a panic when indexing into sheetData.Row[rowIdx].C[-1]. The vulnerability is reachable via any workbook reading API on attacker-controlled input and requires no authentication or user interaction.

Affected products

xuri Excelize versions prior to patch

Identifiers

CVE-2026-107217
GHSA-c85p-xxjj-2r75
GO-2026-6677

Timeline

2026-10-07: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.