Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.
Published: 2026-07-10
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Excelize's streaming worksheet reader does not enforce the TotalRows limit on the row r attribute. An attacker can craft a small XLSX file containing a row index greater than 1,048,576 and omit cell coordinates. When GetRows processes this file it appends empty rows up to the attacker‑controlled index, consuming excessive memory and CPU, which results in a denial of service. This weakness is classified as CWE‑400 and CWE‑770.

Affected Systems

The qax-os:excelize library is affected in every release prior to 2.11.0. Systems that incorporate older versions of the library and process arbitrary XLSX files are impacted.

Risk and Exploitability

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability; attacks are unlikely but possible. The vulnerability is not listed in CISA KEV. An attacker can trigger the flaw by supplying the crafted XLSX file to any application that uses Excelize, making the problem actionable.

Generated by OpenCVE AI on July 31, 2026 at 13:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Excelize library to version 2.11.0 or later, which addresses the row‑bound bypass.
  • Prior to invoking GetRows on any .xlsx file, validate that the maximum row index does not exceed 1,048,576.
  • Implement runtime monitoring of memory and CPU consumption during spreadsheet processing and enforce limits to mitigate potential resource exhaustion.

Generated by OpenCVE AI on July 31, 2026 at 13:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Qax-os
Qax-os excelize
Vendors & Products Qax-os
Qax-os excelize

Fri, 10 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Description Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.
Title Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
Weaknesses CWE-400
CWE-770
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Qax-os Excelize
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-14T01:55:21.372Z

Reserved: 2026-07-02T16:50:27.887Z

Link: CVE-2026-59161

cve-icon Vulnrichment

Updated: 2026-07-14T01:55:14.673Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T13:15:03Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling