# CVE-2026-107225: Excelize GetStyle panic on negative style IDs

Source: https://junglewise.ai/threats/cve-2026-107225-excelize-getstyle-panics-on-a-negative-fillid-borderid-or-fontid  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-107225 · Severity: medium · CVSS 6.5 · Published 2026-10-07

Excelize is a library for reading and writing Excel spreadsheets. A maliciously crafted .xlsx file with negative style IDs in its internal structure can crash any application using Excelize to read cell styles, causing a denial of service. An attacker can deliver such a file via email or download to take down a service or CLI tool that processes untrusted spreadsheets.

Technologies: [Excelize](https://junglewise.ai/threats/technologies/excelize-excelize), [github.com/xuri/excelize/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-xuri-excelize-v2). Vendors: [Excelize](https://junglewise.ai/threats/vendors/excelize), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-107225 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107225 being exploited in the wild.

**How severe is CVE-2026-107225?** Medium severity, with a CVSS score of 6.5, published 7 October 2026.

**Which products and versions are affected?** github.com/xuri/excelize/v2 (Go) >= 2.8.0, < 2.11.1-0.20260731010303-ae2113b410e5, SEMVER:introduced=2.8.0,fixed=2.11.1-0.20260731010303-ae2113b410e5.

**Is there a fix for CVE-2026-107225?** Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260731010303-ae2113b410e5 or later. Until then: Validate and sanitize .xlsx files before processing them with Excelize, or implement panic recovery middleware in calling applications to prevent service crashes on malformed input. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107225 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107225?** Check whether you run Excelize or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260731010303-ae2113b410e5 or later

  ```sh
  go get github.com/xuri/excelize/v2@v2.11.1-0.20260731010303-ae2113b410e5
  ```


Validate and sanitize .xlsx files before processing them with Excelize, or implement panic recovery middleware in calling applications to prevent service crashes on malformed input.

## Technical details

The GetStyle function in styles.go indexes fill, border, and font lookup tables using values from the styles.xml file without validating that IDs are non-negative; it only checks the upper bound. Negative fillId, borderId, or fontId values cause array indexing to panic at a negative index, crashing the process because excelize has no panic recovery. The fix requires adding lower-bound checks to match the validation already present for other style indices.

## Affected products

- excelize Excelize

## Identifiers

- CVE-2026-107225
- GHSA-5h23-36rv-pm65
- GO-2026-6674

## Timeline

- 2026-10-07: disclosed

## Related threats

- [Excelize unchecked pivot-cache field index bounds in extractPivotTableFields](https://junglewise.ai/threats/cve-2026-107211-excelize-unchecked-pivot-cache-field-index-in)
- [Excelize unbounded row iteration denial of service](https://junglewise.ai/threats/cve-2026-107212-excelize-unbounded-row-number-in-rows-columns-makes-getrows-and)
- [Excelize nil-pointer dereference in GetSlicers](https://junglewise.ai/threats/cve-2026-107213-excelize-nil-pointer-dereference-in-getslicers-when-a-worksheet)
- [Excelize Decrypt panic on malformed OLE encrypted workbooks](https://junglewise.ai/threats/cve-2026-107214-excelize-decrypt-unrecoverable-panics-on-malformed-ole-cfb)
- [Excelize extractPart unbounded buffer allocation DoS](https://junglewise.ai/threats/cve-2026-107215-excelize-extractpart-allocates-attacker-controlled-unbounded-and)