Is CVE-2026-107225 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107225 being exploited in the wild.

How severe is CVE-2026-107225?

Medium severity, with a CVSS score of 6.5, published 7 October 2026.

Which products and versions are affected?

github.com/xuri/excelize/v2 (Go) >= 2.8.0, < 2.11.1-0.20260731010303-ae2113b410e5, SEMVER:introduced=2.8.0,fixed=2.11.1-0.20260731010303-ae2113b410e5.

How is CVE-2026-107225 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107225?

Check whether you run Excelize or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107225: Excelize GetStyle panic on negative style IDs

Q: Is there a fix for CVE-2026-107225?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260731010303-ae2113b410e5 or later. Until then: Validate and sanitize .xlsx files before processing them with Excelize, or implement panic recovery middleware in calling applications to prevent service crashes on malformed input. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107225 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107225?

Check whether you run Excelize or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107225 · Severity: medium · CVSS 6.5 · Published 2026-10-07

Excelize is a library for reading and writing Excel spreadsheets. A maliciously crafted .xlsx file with negative style IDs in its internal structure can crash any application using Excelize to read cell styles, causing a denial of service. An attacker can deliver such a file via email or download to take down a service or CLI tool that processes untrusted spreadsheets.

Technologies: Excelize, github.com/xuri/excelize/v2 (Go). Vendors: Excelize, Go.

Quick answers

Is CVE-2026-107225 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107225 being exploited in the wild.
How severe is CVE-2026-107225?: Medium severity, with a CVSS score of 6.5, published 7 October 2026.
Which products and versions are affected?: github.com/xuri/excelize/v2 (Go) >= 2.8.0, < 2.11.1-0.20260731010303-ae2113b410e5, SEMVER:introduced=2.8.0,fixed=2.11.1-0.20260731010303-ae2113b410e5.
Is there a fix for CVE-2026-107225?: Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260731010303-ae2113b410e5 or later. Until then: Validate and sanitize .xlsx files before processing them with Excelize, or implement panic recovery middleware in calling applications to prevent service crashes on malformed input. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107225 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107225?: Check whether you run Excelize or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260731010303-ae2113b410e5 or later
```
go get github.com/xuri/excelize/v2@v2.11.1-0.20260731010303-ae2113b410e5
```

Validate and sanitize .xlsx files before processing them with Excelize, or implement panic recovery middleware in calling applications to prevent service crashes on malformed input.

Technical details

The GetStyle function in styles.go indexes fill, border, and font lookup tables using values from the styles.xml file without validating that IDs are non-negative; it only checks the upper bound. Negative fillId, borderId, or fontId values cause array indexing to panic at a negative index, crashing the process because excelize has no panic recovery. The fix requires adding lower-bound checks to match the validation already present for other style indices.

Affected products

excelize Excelize

Identifiers

CVE-2026-107225
GHSA-5h23-36rv-pm65
GO-2026-6674

Timeline

2026-10-07: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.