CVE-2026-59162

Katalog CVE

CVSS 7.5 · High EPSS 0,66%

Kerentanan Uncaught Exception pada excelize. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with -1 to trigger sharedStrings[-1] and panic when read through GetCellValue or GetRows. This issue is fixed in version 2.11.0.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-248: Uncaught Exception
CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/qax-os/excelize/security/advisories/GHSA-fx5j-qcqg-grpf exploit · advisory vendor
• https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453 patch
• https://github.com/qax-os/excelize/pull/2331 issue tracking · patch
• https://github.com/qax-os/excelize/releases/tag/v2.11.0 release notes