Is CVE-2026-107220 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107220 being exploited in the wild.

How severe is CVE-2026-107220?

Medium severity, with a CVSS score of 6.5, published 7 October 2026.

Which products and versions are affected?

Excelize v2.11.0 and earlier; github.com/xuri/excelize/v2 (Go) >= 2.7.1, < 2.11.1-0.20260820023833-99903a3240e5, SEMVER:introduced=2.7.1,fixed=2.11.1-0.20260820023833-99903a3240e5.

How is CVE-2026-107220 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107220?

Check whether you run Excelize or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107220: Excelize panic in cellInRange on empty mergeCell ref

Q: Is there a fix for CVE-2026-107220?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260820023833-99903a3240e5 or later. Until then: Do not process untrusted Excel files with Excelize until patched, or wrap cell reading operations in recover() to gracefully handle panics. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107220 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107220?

Check whether you run Excelize or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107220 · Severity: medium · CVSS 6.5 · Published 2026-10-07

Excelize is a Go library for reading and writing Excel files. An attacker can craft a malicious Excel file with an empty merge cell reference that causes any application using Excelize to crash when reading cell values, potentially leading to denial of service attacks against services that process untrusted workbooks.

Technologies: Excelize, github.com/xuri/excelize/v2 (Go). Vendors: Excelize, Go.

Quick answers

Is CVE-2026-107220 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107220 being exploited in the wild.
How severe is CVE-2026-107220?: Medium severity, with a CVSS score of 6.5, published 7 October 2026.
Which products and versions are affected?: Excelize v2.11.0 and earlier; github.com/xuri/excelize/v2 (Go) >= 2.7.1, < 2.11.1-0.20260820023833-99903a3240e5, SEMVER:introduced=2.7.1,fixed=2.11.1-0.20260820023833-99903a3240e5.
Is there a fix for CVE-2026-107220?: Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260820023833-99903a3240e5 or later. Until then: Do not process untrusted Excel files with Excelize until patched, or wrap cell reading operations in recover() to gracefully handle panics. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107220 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107220?: Check whether you run Excelize or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260820023833-99903a3240e5 or later
```
go get github.com/xuri/excelize/v2@v2.11.1-0.20260820023833-99903a3240e5
```

Do not process untrusted Excel files with Excelize until patched, or wrap cell reading operations in recover() to gracefully handle panics.

Technical details

A missing bounds check in the cellInRange function allows an empty rectangle slice to be indexed at four positions when processing a malformed mergeCell element with an empty ref attribute. The vulnerability is triggered by any non-streaming cell API (GetCellValue, SetCellValue, GetCellType, GetCellFormula, GetPictures) on opening an untrusted workbook, as the empty ref bypasses the rectangle population logic in mergeCellsParser. This is a regression introduced in commit a34c81e (PR #1500, March 2023) which removed a length guard during refactoring.

Affected products

excelize Excelize v2.11.0 and earlier

Identifiers

CVE-2026-107220
GHSA-g27h-8qhm-6pff
GO-2026-6680

Timeline

2026-10-07: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.