CVE-2026-128344: ExcelJS through 4.4.0 Memory Exhaustion via Oversized Image Anchor Column
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages() anchor positions makes Worksheet.getColumn allocate millions of Column objects and abort with a heap out-of-memory error.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications that read attacker-supplied Excel workbooks with ExcelJS through 4.4.0 and access image anchor positions through getImages() are exposed. A specially crafted drawing part can cause excessive memory allocation and terminate the process with a heap out-of-memory error.
What does an attacker need to exploit it?
The attacker needs to supply a workbook whose drawing XML contains an image anchor with an extremely large column value, such as 300000000. No authentication or user interaction is required according to the provided vector.
Are normal workbooks affected?
The issue requires a malformed or malicious workbook with an unbounded image anchor column in its drawing part. The provided information does not indicate that ordinary workbooks trigger the condition.
What can be done if upgrading is not immediately possible?
Avoid processing untrusted workbooks with affected ExcelJS versions, particularly workflows that call getImages() or otherwise read image anchor positions. Reject or sanitize workbooks with drawing XML containing unreasonably large anchor column values.