Is CVE-2026-107223 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107223 being exploited in the wild.

How severe is CVE-2026-107223?

High severity, with a CVSS score of 4, published 7 October 2026.

Which products and versions are affected?

github.com/360EntSecGroup-Skylar/excelize/v2 (Go) SEMVER:introduced=2.1.0; github.com/xuri/excelize/v2 (Go) >= 2.1.0, < 2.11.1-0.20260807015645-a54c578af309, SEMVER:introduced=0,fixed=2.11.1-0.20260807015645-a54c578af309, SEMVER:introduced=2.1.0,fixed=2.11.1-0.20260807015645-a54c578af309.

Is there a fix for CVE-2026-107223?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260807015645-a54c578af309 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107223 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107223?

Check whether you run github.com/360EntSecGroup-Skylar/excelize/v2 (Go), github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107223: Excelize unbounded column max attribute causes denial of service

Q: Is there a fix for CVE-2026-107223?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260807015645-a54c578af309 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107223 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107223?

Check whether you run github.com/360EntSecGroup-Skylar/excelize/v2 (Go), github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107223 · Severity: high · CVSS 4 · Published 2026-10-07

Excelize is a Go library for reading and writing spreadsheet files. An attacker can craft a malicious Excel file with an extremely large column range specification in the XML, which causes any application that opens the file and modifies a column to hang or crash with out-of-memory errors. This is an availability attack requiring only the ability to upload or provide a spreadsheet file.

Technologies: github.com/360EntSecGroup-Skylar/excelize/v2 (Go), github.com/xuri/excelize/v2 (Go), Xuri Excelize. Vendors: Go, Xuri.

Quick answers

Is CVE-2026-107223 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107223 being exploited in the wild.
How severe is CVE-2026-107223?: High severity, with a CVSS score of 4, published 7 October 2026.
Which products and versions are affected?: github.com/360EntSecGroup-Skylar/excelize/v2 (Go) SEMVER:introduced=2.1.0; github.com/xuri/excelize/v2 (Go) >= 2.1.0, < 2.11.1-0.20260807015645-a54c578af309, SEMVER:introduced=0,fixed=2.11.1-0.20260807015645-a54c578af309, SEMVER:introduced=2.1.0,fixed=2.11.1-0.20260807015645-a54c578af309.
Is there a fix for CVE-2026-107223?: Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260807015645-a54c578af309 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107223 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107223?: Check whether you run github.com/360EntSecGroup-Skylar/excelize/v2 (Go), github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260807015645-a54c578af309 or later
```
go get github.com/xuri/excelize/v2@v2.11.1-0.20260807015645-a54c578af309
```

Technical details

The vulnerability exists in the flatCols() function which iterates from col.Min to col.Max without validating against MaxColumns (16384). The max attribute is read directly from the XML with no bounds checking, and then expanded via deepcopy per iteration, causing linear memory and CPU growth with the max value. Column mutator entry points (SetColWidth, SetColStyle, SetColVisible, SetColOutlineLevel) all invoke flatCols() on the untrusted file-loaded column list, bypassing any caller-level validation.

Affected products

xuri Excelize

Identifiers

CVE-2026-107223
GHSA-fq3v-74gv-27gm
GO-2026-6678

Timeline

2026-10-07: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.