Is CVE-2026-107219 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107219 being exploited in the wild.

How severe is CVE-2026-107219?

High severity, with a CVSS score of 7.5, published 7 October 2026.

Which products and versions are affected?

Excelize v2.3.1 through v2.11.0; github.com/360EntSecGroup-Skylar/excelize/v2 (Go) SEMVER:introduced=2.3.1; github.com/xuri/excelize/v2 (Go) >= 2.3.1, < 2.11.1-0.20260906004932-2badfcd5841d, SEMVER:introduced=0,fixed=2.11.1-0.20260906004932-2badfcd5841d, SEMVER:introduced=2.3.1,fixed=2.11.1-0.20260906004932-2badfcd5841d.

How is CVE-2026-107219 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107219?

Check whether you run Excelize, github.com/360EntSecGroup-Skylar/excelize/v2 (Go) or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107219: Excelize unbounded spinCount in agile decryption DoS

Q: Is there a fix for CVE-2026-107219?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260906004932-2badfcd5841d or later. Until then: Implement an upper bound on spinCount during decryption (e.g., 100,000 to match legitimate Excel/LibreOffice values) to reject files with unreasonably high values, or add context cancellation support to the OpenFile function to allow callers to enforce timeouts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107219 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107219?

Check whether you run Excelize, github.com/360EntSecGroup-Skylar/excelize/v2 (Go) or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107219 · Severity: high · CVSS 7.5 · Published 2026-10-07

Excelize is a Go library for reading and writing Excel spreadsheets. A specially crafted file with an extremely high spinCount value in its encryption metadata can cause the OpenFile function to consume excessive CPU time during decryption, effectively freezing the application for minutes or longer. An attacker can trigger this via a malicious file regardless of whether password protection is actually enabled, making any service that opens user-supplied files vulnerable to denial of service.

Technologies: Excelize, github.com/360EntSecGroup-Skylar/excelize/v2 (Go), github.com/xuri/excelize/v2 (Go). Vendors: Excelize, Go.

Quick answers

Is CVE-2026-107219 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107219 being exploited in the wild.
How severe is CVE-2026-107219?: High severity, with a CVSS score of 7.5, published 7 October 2026.
Which products and versions are affected?: Excelize v2.3.1 through v2.11.0; github.com/360EntSecGroup-Skylar/excelize/v2 (Go) SEMVER:introduced=2.3.1; github.com/xuri/excelize/v2 (Go) >= 2.3.1, < 2.11.1-0.20260906004932-2badfcd5841d, SEMVER:introduced=0,fixed=2.11.1-0.20260906004932-2badfcd5841d, SEMVER:introduced=2.3.1,fixed=2.11.1-0.20260906004932-2badfcd5841d.
Is there a fix for CVE-2026-107219?: Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260906004932-2badfcd5841d or later. Until then: Implement an upper bound on spinCount during decryption (e.g., 100,000 to match legitimate Excel/LibreOffice values) to reject files with unreasonably high values, or add context cancellation support to the OpenFile function to allow callers to enforce timeouts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107219 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107219?: Check whether you run Excelize, github.com/360EntSecGroup-Skylar/excelize/v2 (Go) or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260906004932-2badfcd5841d or later
```
go get github.com/xuri/excelize/v2@v2.11.1-0.20260906004932-2badfcd5841d
```

Implement an upper bound on spinCount during decryption (e.g., 100,000 to match legitimate Excel/LibreOffice values) to reject files with unreasonably high values, or add context cancellation support to the OpenFile function to allow callers to enforce timeouts.

Technical details

The vulnerability exists in the OpenFile function which branches on the OLE magic number in the file header and initiates decryption without checking whether a password was provided or encryption is actually present. The agileDecrypt function calls convertPasswdToKey with a spinCount value read directly from the file's EncryptionInfo stream via xml.Unmarshal with no upper bound, causing a key-derivation loop to execute an arbitrary number of times. An attacker can set spinCount to 100 million or higher, forcing linear CPU consumption at ~0.6 microseconds per iteration; a value of 1e9 produces roughly 10 minutes of CPU burn with no possibility for the caller to cancel via context.

Affected products

Excelize Excelize v2.3.1 through v2.11.0

Identifiers

CVE-2026-107219
GHSA-jrfj-fhj2-jjvm
GO-2026-6681

Timeline

2026-10-07: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.