CVE-2026-107223: falha de alta gravidade em qax-os excelize
Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
Publicada em
18Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
qax-os · excelizeCVEs relacionadas — qax-os excelize
No mesmo produto, das mais perigosas para as menos.
CVE-2026-59162MEDIUMExcelize: Negative shared-string index causes panic in GetCellValue and GetRowsEPSS 0.7%CVE-2026-59161HIGHExcelize: Streaming GetRows row-bound bypass causes attacker-controlled allocationEPSS 0.7%CVE-2026-54063HIGHExcelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)EPSS 0.6%CVE-2026-107225MEDIUMExcelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xmlEPSS —CVE-2026-107224MEDIUMExcelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReaderEPSS —CVE-2026-107222MEDIUMExcelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil checkEPSS —