{"id":"CVE-2026-128339","aliases":[],"cve":{"records":[{"id":"CVE-2026-128339","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-13T01:20:40.642Z","published":"2026-11-13T09:33:36.382Z","modified":"2026-11-13T22:31:28.386Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-13T09:33:36.382Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T22:31:28.386Z"}],"references":[{"url":"https://github.com/exceljs/exceljs","tags":["product"],"source":"VulnCheck"},{"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-wh3v-83h4-rwwq","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L613-L632","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L895-L901","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/exceljs/exceljs/issues/3107","tags":["issue-tracking"],"source":"VulnCheck"},{"url":"https://github.com/exceljs/exceljs/pull/3114","tags":["issue-tracking","patch"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-merged-cell-range","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-770","description":"Allocation of Resources Without Limits or Throttling","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*","versionEndIncluding":"4.4.0"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T16:34:17.732109Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"ExcelJS through 4.4.0 Memory Exhaustion via Oversized Merged Cell Range","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process.","score":8.7,"severity":"high","published":"2026-11-13T09:33:36.382Z","modified":"2026-11-13T22:31:28.386Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"exceljs","name":"exceljs","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.4.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","packageIdentity":{"ecosystem":"npm","name":"exceljs"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-128339"}],"remediation":[],"references":["https://github.com/exceljs/exceljs","https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-wh3v-83h4-rwwq","https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L613-L632","https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L895-L901","https://github.com/exceljs/exceljs/issues/3107","https://github.com/exceljs/exceljs/pull/3114","https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-merged-cell-range"],"sources":[{"name":"CVE","id":"CVE-2026-128339","modified":"2026-11-13T22:31:28.386Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-128339"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-13T23:02:10.928Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:20:33.177Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T23:10:31.417Z","attemptedAt":"2026-11-13T23:10:31.417Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T23:10:30.486Z","attemptedAt":"2026-11-13T23:10:30.486Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T23:10:31.416Z","attemptedAt":"2026-11-13T23:10:31.416Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T23:10:31.417Z","attemptedAt":"2026-11-13T23:10:31.417Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-5pwm-xv7w-v3cm","url":"https://github.com/advisories/GHSA-5pwm-xv7w-v3cm","modified":"2026-11-13T12:31:48Z","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-13T23:10:30.486Z"},{"source":"ENISA EUVD","id":"EUVD-2026-125038","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125038","modified":"Nov 13, 2026, 10:31:28 PM","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-13T23:10:31.416Z"},{"source":"FIRST EPSS","id":"CVE-2026-128339","url":"https://www.first.org/epss/","probability":0.007,"percentile":0.53716,"date":"2026-11-13","checkedAt":"2026-11-13T23:10:31.417Z"},{"source":"NVD","id":"CVE-2026-128339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128339","modified":"2026-11-13T15:48:52.237","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-13T23:10:31.417Z"},{"source":"NVD","id":"CVE-2026-128339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128339","modified":"2026-11-13T15:48:52.237","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-13T23:10:31.417Z"}],"aiSummary":{"text":"ExcelJS through version 4.4.0 has a memory exhaustion vulnerability via oversized merged cell ranges, allowing attackers to crash applications. The weakness is due to unbounded allocation of resources. Affected versions are those less than or equal to 4.4.0.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T23:06:11.686Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-128339"}]}}