Is CVE-2026-54063 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54063 being exploited in the wild.

How severe is CVE-2026-54063?

High severity, with a CVSS score of 7.5, published 10 July 2026.

Which products and versions are affected?

github.com/xuri/excelize/v2 (Go) < 2.11.0, SEMVER:introduced=0,fixed=2.11.0; Xuri Excelize < 2.11.0.

Is there a fix for CVE-2026-54063?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54063 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54063?

Check whether you run github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54063: Excelize unbounded memory allocation in checkSheet function

Q: Is there a fix for CVE-2026-54063?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54063 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54063?

Check whether you run github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54063 · Severity: high · CVSS 7.5 · Published 2026-07-10

A vulnerability in the Excelize library, used by Go applications to process Excel files, allows an attacker to crash the application or exhaust its memory. By providing a specially crafted spreadsheet file, an attacker can force the system to attempt a massive memory allocation or trigger a software error. This can lead to a complete service outage for any application that processes user-uploaded Excel documents.

Technologies: github.com/xuri/excelize/v2 (Go), Xuri Excelize. Vendors: Go, Xuri.

Quick answers

Is CVE-2026-54063 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54063 being exploited in the wild.
How severe is CVE-2026-54063?: High severity, with a CVSS score of 7.5, published 10 July 2026.
Which products and versions are affected?: github.com/xuri/excelize/v2 (Go) < 2.11.0, SEMVER:introduced=0,fixed=2.11.0; Xuri Excelize < 2.11.0.
Is there a fix for CVE-2026-54063?: Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54063 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54063?: Check whether you run github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xuri/excelize/v2 (Go): upgrade to 2.11.0 or later
```
go get github.com/xuri/excelize/v2@v2.11.0
```

Technical details

The vulnerability exists in the `checkSheet()` function within `github.com/xuri/excelize/v2`. The parser reads the `<row r="N">` XML attribute and uses it directly as a length argument for `make([]xlsxRow, row)` without validating it against the `TotalRows` limit (1,048,576). An attacker can provide a large integer (e.g., 2147483647) to trigger an out-of-memory (OOM) fatal error or a negative value (e.g., -1) to trigger a runtime panic due to out-of-bounds slice indexing. The issue is reachable via public APIs like `GetCellValue` that internally invoke the worksheet reader. A fix is available in version 2.11.0.

Affected products

xuri excelize < 2.11.0

Identifiers

CVE-2026-54063
GHSA-h69g-9hx6-f3v4
GO-2026-5960

Timeline

2026-06-03: disclosed
2026-07-10: advisory: GHSA-h69g-9hx6-f3v4 published
2026-07-10: patched: Fixed in version 2.11.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.