CVE-2026-107212

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.

• CWE-770

• https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23
• https://github.com/qax-os/excelize/pull/2438
• https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107207LMCache through 0.5.5 contains a server-side request forgery…7.2
• CVE-2026-107208ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-107209ImageMagick is free and open-source software used for editin…5.9
• CVE-2026-10721Concrete CMS below 9.5.2 is vulnerable to PHP Object Injecti…8.4
• CVE-2026-107210ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-107211Excelize is a Go language library for reading and writing Mi…8.7
• CVE-2026-107213Excelize is a Go language library for reading and writing Mi…8.7
• CVE-2026-107214Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-107215Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-107216Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-10722A vulnerability has been found in cilium ebpf up to 0.21.0. …5.5
• CVE-2026-10723BIND may accept incorrect child-zone NSEC3 records as valid,…6.8