Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes the unbounded spinCount to convertPasswdToKey before password verification. When a crafted OLE encrypted-workbook header supplies an excessive spinCount and the file is opened, the key-derivation loop performs unbounded attacker-selected work and cannot be cancelled, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
Published: 2026-10-07
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via CPU exhaustion
Action: Apply Patch
AI Analysis

Impact

The vulnerability lies in the aggressive decryption routine of the Excelize library, which accepts an attacker-controlled spinCount parameter in the OLE encrypted‑workbook header. When this value is set excessively high, the password‑key derivation loop performs that many iterations before any password verification occurs, consuming CPU resources for an attacker‑chosen duration. The flaw does not allow code execution or disclosure of information, but it can degrade system performance or deny service to legitimate users by monopolizing processor time.

Affected Systems

qax-os Excelize, versions 2.3.1 through 2.11.0 inclusive are affected. Any application that loads Excel files using these library versions is at risk.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity impact. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or network‑based delivery of a malicious workbook file that is processed by an application using the vulnerable library, at which point the CPU‑intensive key‑derivation loop will be executed with the supplied spinCount.

Generated by OpenCVE AI on October 7, 2026 at 19:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Excelize library to a version released after 2.11.0 once a patch becomes available.
  • If no patch version is available, backport the commit that limits the spinCount into the current library.
  • Apply a patch or wrapper that imposes a maximum value on spinCount before processing or introduces a timeout to prevent the decryption loop from running indefinitely.
  • Monitor application CPU usage for anomalous spikes when processing Excel files and implement rate‑limiting or quotas on file uploads to mitigate potential denial‑of‑service attempts.

Generated by OpenCVE AI on October 7, 2026 at 19:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-jrfj-fhj2-jjvm Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Excelize
Excelize excelize
CPEs cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:*
Vendors & Products Excelize
Excelize excelize

Wed, 07 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Qax-os
Qax-os excelize
Vendors & Products Qax-os
Qax-os excelize

Wed, 07 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes the unbounded spinCount to convertPasswdToKey before password verification. When a crafted OLE encrypted-workbook header supplies an excessive spinCount and the file is opened, the key-derivation loop performs unbounded attacker-selected work and cannot be cancelled, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
Title Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Excelize Excelize
Qax-os Excelize
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-07T19:45:16.819Z

Reserved: 2026-10-07T14:34:14.816Z

Link: CVE-2026-107219

cve-icon Vulnrichment

Updated: 2026-10-07T19:44:58.740Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-07T19:17:34.287

Modified: 2026-10-13T14:23:15.890

Link: CVE-2026-107219

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T20:00:12Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption