Excessive SpinCount Vulnerability in Excelize Go Library

CVE-2026-107219

What is CVE-2026-107219?

The vulnerability in the Excelize library affects versions from 2.3.1 to 2.11.0, where an attacker can manipulate an unbounded spinCount parameter during password key derivation. This occurs within the agile decryption method when handling OLE encrypted workbooks. By providing a crafted workbook header with a high spinCount, an attacker may cause excessive CPU usage for an indefinite period, leading to potential denial of service as legitimate processes are starved of resources. Currently, no fixed version is available, making it vital for users to take precautions.

References