Loading story…
The maintainers of the Go spreadsheet library Excelize patched two security flaws in v2.11.0, including CVE-2026-59161, a denial-of-service issue in the streaming worksheet reader used by Rows and GetRows. In affected versions before 2.11.0, a crafted XLSX file could set a worksheet row r attribute above Excel's maximum of 1,048,576 and omit cell coordinates, causing GetRows to append empty rows up to an attacker-controlled index and consume excessive memory and CPU.
The same fix set also addressed a second bug that could trigger a panic when retrieving a cell value with an invalid shared string table index. The changes, merged through pull request #2331 and commit 93f0b3caed37f21ef5079e3259c6c21dcfe68453, added explicit row-limit validation, bounds checks, and structured error handling instead of panics, with updated unit tests confirming both protections. Organizations using Excelize to process untrusted spreadsheet files should upgrade to v2.11.0.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
GitHub Security Advisories newly received CVE-2026-59161, a denial-of-service flaw in Excelize's streaming worksheet reader that could allow attacker-controlled memory and CPU consumption. The issue affected versions prior to 2.11.0 and was noted as fixed in version 2.11.0.
Excelize version 2.11.0 was released, addressing three security issues: CVE-2026-54063, CVE-2026-59161, and CVE-2026-59162. The release also included breaking API changes, bug fixes, performance improvements, and raised the minimum supported Go version to 1.25.0.
A patch was merged into the qax-os Excelize master branch to fix two security issues: attacker-controlled memory allocation via worksheet row number overflow and a panic caused by invalid shared string table indexes. The fixes added row bounds validation, replaced panic behavior with structured errors, and were associated with Excelize v2.11.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **`CVE-2026-62870`**, a high-severity remote code execution vulnerability in **Microsoft Excel** caused by a use-after-free flaw. The bug carries a **CVSS v3.1 score of 8.8** and affects **Microsoft 365 Apps for Enterprise**, **Excel 2016**, **Office 2019**, **Office LTSC 2021**, and **Office LTSC 2024** on both **32-bit** and **x64-based** systems. According to the advisory, an unauthenticated attacker could exploit the flaw over a network by delivering a specially crafted Excel file and executing code in the context of the current user. Microsoft released security updates addressing the issue, and reporting indicates exploitation requires **user interaction** to open the malicious file. Successful compromise could let attackers install malware, steal data, and pivot further into enterprise environments depending on the victim's privileges. At the time of publication, there was **no public exploit** and **no confirmed active exploitation**, and the vulnerability had **not** been added to **CISA's Known Exploited Vulnerabilities catalog**.
Aug 4, 2026
Microsoft published a long series of security advisories for **remote code execution** vulnerabilities affecting core Office components, with the largest concentration in **Excel** and **Word**. The disclosures include Excel flaws such as `CVE-2024-49026`, `CVE-2024-49069`, `CVE-2025-21362`, `CVE-2025-21381`, `CVE-2025-21387`, `CVE-2025-24082`, `CVE-2025-62553`, `CVE-2026-26107`, `CVE-2026-26109`, `CVE-2026-26112`, and `CVE-2026-40359`, alongside Word issues including `CVE-2025-24077`, `CVE-2025-24078`, `CVE-2025-47170`, `CVE-2025-49700`, `CVE-2025-59222`, `CVE-2026-23657`, and `CVE-2026-33095`. Microsoft also listed related RCE bugs in **Microsoft Office** (`CVE-2025-21392`), **PowerPoint** (`CVE-2025-54908`), **Inbox COM Objects (Global Memory)** (`CVE-2025-58730`), and the **Visual Studio Code Python Extension** (`CVE-2025-49714`). One of the few entries with technical detail, **`CVE-2026-40359`**, describes an **Important** Excel use-after-free flaw (`CWE-416`) with a **CVSS 3.1 score of 7.8** that can let an attacker execute code if a user opens a malicious Office file. Microsoft said the bug was **not publicly disclosed**, **not exploited in the wild**, and **less likely** to be exploited at the time of publication, adding that the **Preview Pane is not an attack vector** and that a fix is available. Taken together, the advisories show Microsoft continuing to address document-driven code execution risks across Office products, where successful exploitation generally depends on **user interaction with crafted files** rather than direct network exposure.
Jun 29, 2026
Microsoft published security advisories for several **remote code execution** vulnerabilities affecting **Microsoft Office** and **Microsoft Excel**, including `CVE-2025-24057`, `CVE-2025-24075`, and `CVE-2025-47162`. The issues were listed in the Microsoft Security Update Guide as Office-family flaws that could allow arbitrary code execution if successfully exploited. The disclosures indicate that the affected attack surface spans both the broader Office suite and Excel specifically, underscoring continued risk from malicious documents and content processed by productivity software. Organizations using Microsoft Office should prioritize review of the relevant advisories and deployment of associated security updates for the affected products tied to these CVEs.
Jul 12, 2026