Is CVE-2026-107224 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107224 being exploited in the wild.

How severe is CVE-2026-107224?

Medium severity, with a CVSS score of 6.5, published 7 October 2026.

Which products and versions are affected?

github.com/360EntSecGroup-Skylar/excelize/v2 (Go) SEMVER:introduced=2.1.0; github.com/xuri/excelize/v2 (Go) >= 2.1.0, < 2.11.1-0.20260805032953-db93f8d89de7, SEMVER:introduced=0,fixed=2.11.1-0.20260805032953-db93f8d89de7, SEMVER:introduced=2.1.0,fixed=2.11.1-0.20260805032953-db93f8d89de7.

How is CVE-2026-107224 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107224?

Check whether you run Excelize, github.com/360EntSecGroup-Skylar/excelize/v2 (Go) or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107224: Excelize zip64 uncompressed size integer overflow panic in OpenFile/OpenReader

Q: Is there a fix for CVE-2026-107224?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260805032953-db93f8d89de7 or later. Until then: Apply the suggested fix of comparing zip64 uncompressed sizes against size limits in unsigned space and independently validating declared sizes before memory allocation, rather than trusting the zip header values after a signed comparison. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-107224 · Severity: medium · CVSS 6.5 · Published 2026-10-07

Excelize is a Go library for reading and writing Microsoft Excel files. A crafted spreadsheet file with a specially-crafted zip64 header can cause the library to panic and crash any application using it, without requiring authentication. An attacker can exploit this by distributing a malicious 159-byte file to take down services that process untrusted spreadsheets.

Technologies: Excelize, github.com/360EntSecGroup-Skylar/excelize/v2 (Go), github.com/xuri/excelize/v2 (Go). Vendors: Excelize, Go.

Quick answers

Is CVE-2026-107224 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107224 being exploited in the wild.
How severe is CVE-2026-107224?: Medium severity, with a CVSS score of 6.5, published 7 October 2026.
Which products and versions are affected?: github.com/360EntSecGroup-Skylar/excelize/v2 (Go) SEMVER:introduced=2.1.0; github.com/xuri/excelize/v2 (Go) >= 2.1.0, < 2.11.1-0.20260805032953-db93f8d89de7, SEMVER:introduced=0,fixed=2.11.1-0.20260805032953-db93f8d89de7, SEMVER:introduced=2.1.0,fixed=2.11.1-0.20260805032953-db93f8d89de7.
Is there a fix for CVE-2026-107224?: Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260805032953-db93f8d89de7 or later. Until then: Apply the suggested fix of comparing zip64 uncompressed sizes against size limits in unsigned space and independently validating declared sizes before memory allocation, rather than trusting the zip header values after a signed comparison.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107224 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107224?: Check whether you run Excelize, github.com/360EntSecGroup-Skylar/excelize/v2 (Go) or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260805032953-db93f8d89de7 or later
```
go get github.com/xuri/excelize/v2@v2.11.1-0.20260805032953-db93f8d89de7
```

Apply the suggested fix of comparing zip64 uncompressed sizes against size limits in unsigned space and independently validating declared sizes before memory allocation, rather than trusting the zip header values after a signed comparison.</anigation> </invoke>

Technical details

A Zip64 uncompressed-size value in the range [2^63, 2^64) is cast to a signed int64, resulting in a negative value that bypasses the unzip-size guard via signed arithmetic comparison. This negative value then reaches make([]byte, 0, negativeCap) in the readFile function, triggering a runtime panic. The vulnerability affects any code path that calls OpenFile or OpenReader with untrusted zip input, and requires no authentication or user interaction beyond opening the file.

Affected products

Excelize Excelize

Identifiers

CVE-2026-107224
GHSA-fw94-4wwp-w8pw
GO-2026-6679

Timeline

2026-10-07: disclosed
2026-10-07: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.