Input Validation Flaw in Excelize Library for Microsoft Excel Spreadsheets

CVE-2026-107218

What is CVE-2026-107218?

The Excelize library, designed for managing Microsoft Excel spreadsheets via Go, suffers from an input validation flaw due to inconsistent handling of character counts during formula evaluations. Specifically, the RIGHT function incorrectly slices a rune array using Unicode code-point counts rather than UTF-16 code-unit counts. This discrepancy can lead to a negative rune-slice index when the criteria of rune counts versus UTF-16 code-unit counts are not aligned during supplementary-plane text evaluation. Consequently, an attacker may exploit this flaw to induce a panic in the system, resulting in unexpected behavior during formula calculations. As of now, there is no version that addresses this vulnerability.

References