Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N N H 7.5 .0039 32.1 —
AFFECTED Product Versions Fixed excelize < 2.11.0 – —
TIMELINE Jun 11 Reserved by GitHub_M Jul 10 EXPLOIT PUBLISHED — CVE-2026-54063 (qax-os excelize). Public exploit reference added. Jul 10 Published (CNA: GitHub_M)
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled <row r="N"> XML attribute value directly as the length argument to make([]xlsxRow, row) without validating it against the Excel row limit (TotalRows = 1,048,576). A specially crafted XLSX file can trigger two denial-of-service variants: (A) an out-of-memory process kill when r=2147483647 forces a ~16 GB allocation attempt, and (B) a runtime panic via out-of-bounds slice indexing when r=-1. Any service that opens attacker-supplied XLSX files and calls GetCellValue is affected. No authentication is required. This issue is fixed in version 2.11.0.
| Date | Event | Detail |
|---|---|---|
| June 11, 2026 | Reserved | Reserved by GitHub_M |
| July 10, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-54063 (qax-os excelize). Public exploit reference added. |
| July 10, 2026 | Published | Published (CNA: GitHub_M) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| qax-os | excelize | — | < 2.11.0 | — |
Authoritative record: CVE-2026-54063 at cve.org
Vendors: qax-os
Weaknesses: CWE-770
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-54063 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.