CVE-2026-107217: fallo de gravedad alta en qax-os excelize
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
Publicada el
18Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5
probabilidad de explotación
—
explotación observada
noninguna fuente lo reporta
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column name to wrap to zero with no error. ColumnNameToNumber accepts the overflowing name VGWQHXLSDVIKWV, after which checkSheetR0 and xlsxWorksheet.checkRow use the wrapped column value as an index. When a crafted worksheet uses an overflowing column name in a row normalized by checkSheetR0 or checkRow, the wrapped zero column becomes a negative slice index during worksheet normalization, allowing an attacker to panic and terminate the calling process. No fixed version is available as of this review.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
qax-os · excelizeCVEs relacionadas — qax-os excelize
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-59162MEDIUMExcelize: Negative shared-string index causes panic in GetCellValue and GetRowsEPSS 0.7%CVE-2026-59161HIGHExcelize: Streaming GetRows row-bound bypass causes attacker-controlled allocationEPSS 0.7%CVE-2026-54063HIGHExcelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)EPSS 0.6%CVE-2026-107225MEDIUMExcelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xmlEPSS —CVE-2026-107224MEDIUMExcelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReaderEPSS —CVE-2026-107223HIGHExcelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the processEPSS —