Loading vulnerability…
CVE-2026-59161 is a denial-of-service vulnerability in the Excelize Go library for reading and writing Microsoft Excel spreadsheets. In versions prior to 2.11.0, the streaming worksheet reader used by the Rows and GetRows APIs does not enforce the worksheet TotalRows limit on the row r attribute. A crafted XLSX document can specify a row number greater than the Excel worksheet maximum of 1,048,576 while omitting cell coordinates, causing GetRows to append empty rows up to an attacker-controlled index. This results in attacker-controlled resource allocation and excessive memory and CPU consumption during workbook processing.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.