{"schema":"threatline.record/2","record":{"id":"CVE-2026-107218","aliases":["GHSA-8jjq-8j9w-m2v6"],"summary":"Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics","details":"`leftRight` (calc.go:14236) tests the length with `countUTF16String`, which counts a rune above U+FFFF as 2. The RIGHT branch on 14241 then slices `[]rune(text)` at `utf8.RuneCountInString(text)-numChars`, which counts it as 1. For text with N such runes the two measures are 2N and N, so any `numChars` between them passes the guard and gives a negative index. The `numChars < 0` check at 14216 does not help, since the value that gets through is positive.\n\nWhat makes it worth reporting is `AutoFitColWidth`, which evaluates formulas without looking like it does, so normalising an uploaded sheet is enough to reach it. One scoping correction to my own wording there: `AutoFitColWidth` was added in v2.11.0 and does not exist at v2.10.1, so on v2.10.1 the only reachable path is an explicit `CalcCellValue`.\n\nA 6,077-byte file containing two U+1D7D9 characters in A1 and  RIGHT(A1,3)  in B1 was created and then opened in a separate program without recovery enabled:\n\n```\nv2.9.1    ok\nv2.10.0   ok\nv2.10.1   panic: slice bounds out of range [-1:]\nv2.11.0   panic: slice bounds out of range [-1:]\n```\n\nSo it is a regression, not an old defect. Commit a880146 (2026-01-16) moved the guard to `countUTF16String` and left the slice on the rune index, and `git tag --contains` gives v2.10.1 and v2.11.0 only.\n\nRIGHT only. RIGHTB reaches the same function but takes the byte branch at 14225, which is internally consistent, and I probed MID and MIDB from 1 to 5 with no panic. It is the same negative-index family as GHSA-fx5j-qcqg-grpf and GHSA-48hm-4h8j-58fg, though those are shared-string lookups in the reader rather than a unit mismatch in the formula library.","categories":["Libraries & packages"],"product":"github.com/xuri/excelize/v2","vendor":"qax-os","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8jjq-8j9w-m2v6","source_modified_at":"2026-10-07T20:23:27Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/xuri/excelize/v2"},"range":">= 2.10.1, < 2.11.1-0.20260908032718-ecd99d761fe0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107218","source_modified_at":"2026-10-07T22:05:36.155Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"excelize","vendor":"qax-os","versions":[{"version":">= 2.10.1, <= 2.11.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8jjq-8j9w-m2v6","source_modified_at":"2026-10-07T20:30:05.877569663Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"github.com/xuri/excelize/v2","ecosystem":"Go","purl":"pkg:golang/github.com/xuri/excelize/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.10.1"},{"fixed":"2.11.1-0.20260908032718-ecd99d761fe0"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8jjq-8j9w-m2v6","source_modified_at":"2026-10-07T20:23:27Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/xuri/excelize/v2"},"version":"2.11.1-0.20260908032718-ecd99d761fe0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8jjq-8j9w-m2v6","source_modified_at":"2026-10-07T20:30:05.877569663Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"github.com/xuri/excelize/v2","ecosystem":"Go","purl":"pkg:golang/github.com/xuri/excelize/v2"},"version":"2.11.1-0.20260908032718-ecd99d761fe0"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00288,"percentile":0.20314,"score_date":"2026-10-23"},"published_at":"2026-10-07T18:29:38.606Z","modified_at":"2026-10-07T22:05:36.155Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-8jjq-8j9w-m2v6","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T20:23:27Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107218","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-07T22:05:36.155Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-8jjq-8j9w-m2v6","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-07T20:30:05.877569663Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107218","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/qax-os/excelize/security/advisories/GHSA-8jjq-8j9w-m2v6","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/qax-os/excelize/pull/2390","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/qax-os/excelize/commit/ecd99d761fe0489f1ed308e2f7dc2e0502d1a396","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-8jjq-8j9w-m2v6","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-07T22:03:39.825103Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-07T22:05:36.155Z","content_hash":"7c7d1b68b4ce2bf091bad0bcb1f0880adef6d9b2368b3a54e801a62ad9f0e9a6"}}