CVE-2026-107212

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23	Patch
https://github.com/qax-os/excelize/pull/2438	Issue Tracking Patch
https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:*

History

13 Oct 2026, 14:24

Type	Values Removed	Values Added
CPE		cpe:2.3:a:excelize:excelize::::::go::*
First Time		Excelize excelize Excelize
References	~~() https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23 -~~	() https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23 - Patch
References	~~() https://github.com/qax-os/excelize/pull/2438 -~~	() https://github.com/qax-os/excelize/pull/2438 - Issue Tracking, Patch
References	~~() https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3 -~~	() https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3 - Exploit, Vendor Advisory

07 Oct 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-07 18:17

Updated : 2026-10-13 14:24

NVD link : CVE-2026-107212

Mitre link : CVE-2026-107212

CVE.ORG link : CVE-2026-107212

JSON object : View

Products Affected

excelize

excelize

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-107212", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107212", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T17:56:16.346533Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "qax-os", "product": "excelize", "versions": [{"status": "affected", "version": ">= 2.1.0, <= 2.11.0"}]}]}], "published": "2026-10-07T18:17:18.670", "references": [{"url": "https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/qax-os/excelize/pull/2438", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review."}], "lastModified": "2026-10-13T14:24:29.523", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "4AA0C5E8-2455-4F63-93FB-6A20E9C7E2CE", "versionEndIncluding": "2.11.0", "versionStartIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}