CVE-2026-107220

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107220
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107220.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107220
Aliases
Published
2026-10-07T18:37:52Z
Modified
2026-10-08T10:45:23Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
Details

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125",
        "CWE-129"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107220.json"
}
References

Affected packages

Git / github.com/qax-os/excelize

Affected ranges

Type
GIT
Repo
https://github.com/qax-os/excelize
Events
Introduced
799317eac596e0b9a8bc6773fb9218e91b14b14c
Last Affected
90ff348959dd842cbf3a4fbd93a78afbe18db476
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.7.1"
        },
        {
            "last_affected": "2.11.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v2.*
v2.10.0
v2.10.1
v2.11.0
v2.7.1
v2.8.0
v2.8.1
v2.9.0
v2.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107220.json"