CVE-2026-107211
Received Received - Intake

Out-of-Bounds Slice Access in Excelize Library

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while processing GetPivotTables and trusts the dataField fld attribute as an index. When a crafted workbook supplies a pivot-field count mismatch or an out-of-range dataField fld value before GetPivotTables is called, the unchecked index causes a Go slice-bounds panic that escapes the library, allowing an attacker to crash the process or request worker. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-08
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-107211
EUVD
EUVD-2026-94526

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qax-os excelize >= 2.8.1, <= 2.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-107211 is an out-of-bounds slice index vulnerability in the Excelize library's extractPivotTableFields function. It occurs when the function uses attacker-controlled integers from XML attributes to index an array without validation. This can cause unrecoverable panics when processing crafted .xlsx files with mismatched pivot table field counts or invalid indices.

Detection Guidance

Detecting this vulnerability requires checking if your system uses Excelize library versions 2.8.1 to 2.11.0. Inspect Go module files or dependencies for excelize versions within this range. No direct network detection commands exist as this is a library-level issue triggered by processing malicious Excel files.

Impact Analysis

This vulnerability allows attackers to crash applications using the Excelize library by supplying maliciously crafted Excel files. The crashes can disrupt services, cause data loss, or enable denial-of-service attacks if the library is used in server-side processing of untrusted files.

Compliance Impact

This vulnerability could impact compliance by enabling denial-of-service attacks or data corruption in systems handling sensitive data. Organizations processing Excel files with Excelize may face disruptions that violate availability requirements in GDPR or HIPAA, potentially leading to compliance violations if proper safeguards are not in place.

Mitigation Strategies

Immediately stop using Excelize library versions 2.8.1 to 2.11.0. If possible, upgrade to a patched version once available. Avoid opening untrusted Excel files until the issue is resolved. Monitor for crashes in applications using Excelize when processing pivot tables.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart