CVE-2026-107213— Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
Quick assessment
Affected
qax-os excelize
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Excelize 是一个用于读写 Microsoft Excel 电子表格的 Go 语言库。在版本 2.9.0 至 2.11.0 中， 方法会检查 （扩展列表），但在解引用 （工作表绘图对象）之前，并未验证该独立可选的绘图元素是否存在。具体而言， 在检测到工作表中的 元素后，会读取 ，即使该工作表的独立可选绘图元素并不存在。当构造的工作表包含一个没有关联绘图元素的 元素，且应用程序调用 时，在解析绘图关系期间会解引用 的空指针（nil pointer），从而导致程序发生 panic 并终止未受保护的应用进程。截至本
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107213
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
Source: CVE Program / CVE List V5
Vulnerability Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. File.GetSlicers reads ws.Drawing.RID after seeing a worksheet extLst element even when the independently optional worksheet drawing element is absent. When a crafted worksheet contains an extLst element without a drawing element and the application calls GetSlicers, the nil ws.Drawing pointer is dereferenced while resolving the drawing relationship, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-107213
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107213
请登录查看更多情报信息。
Other References for CVE-2026-107213 (3)
-
https://github.com/qax-os/excelize/pull/2434 x_refsource_MISC
-
https://github.com/qax-os/excelize/security/advisories/GHSA-r7x5-4969-99p7 x_refsource_CONFIRM
Same Patch Batch · qax-os · 2026-10-07 · 15 CVEs total
| CVE-2026-107211 | 8.7 HIGH | Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverabl |
| CVE-2026-107212 | 7.5 HIGH | Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop fo |
| CVE-2026-107214 | 7.5 HIGH | Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks |
| CVE-2026-107216 | 7.5 HIGH | Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entra |
| CVE-2026-107215 | 7.5 HIGH | Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers |
| CVE-2026-107217 | 7.5 HIGH | Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil er |
| CVE-2026-107219 | 7.5 HIGH | Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile |
| CVE-2026-107223 | 7.1 HIGH | Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded pe |
| CVE-2026-107220 | 6.5 MEDIUM | Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref |
| CVE-2026-107221 | 6.5 MEDIUM | Excelize: a row whose earlier cell has a higher column reference than its last cell panics |
| CVE-2026-107222 | 6.5 MEDIUM | Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no l |
| CVE-2026-107225 | 6.5 MEDIUM | Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml |
| CVE-2026-107224 | 6.5 MEDIUM | Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader |
| CVE-2026-107218 | 5.3 MEDIUM | Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics |
IV. Related Vulnerabilities
Same product: excelize
-
CVE-2026-107225
Excelize: GetStyle panics on a negative fillId, borderId or -
CVE-2026-107224
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/ -
CVE-2026-107223
Excelize: Unbounded <col max> attribute is loaded with no Ma -
CVE-2026-107222
Excelize: GetConditionalFormats indexes conditional-formatti -
CVE-2026-107221
Excelize: a row whose earlier cell has a higher column refer
Same vendor: qax-os
-
CVE-2026-107225
Excelize: GetStyle panics on a negative fillId, borderId or -
CVE-2026-107224
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/ -
CVE-2026-107223
Excelize: Unbounded <col max> attribute is loaded with no Ma -
CVE-2026-107222
Excelize: GetConditionalFormats indexes conditional-formatti -
CVE-2026-107221
Excelize: a row whose earlier cell has a higher column refer
Same weakness: CWE-476
-
CVE-2026-107169
M17n-lib: null-pointer write in read_mtext_element() on malf -
CVE-2026-107170
M17n-lib: null dereference in minput_open_im() after failed -
CVE-2026-102169
Security Advisory 0194 -
CVE-2026-104044
Sssd: sssd: denial of service via crafted passkey kerberos a -
CVE-2026-104038
Sssd: sssd: denial of service via missing sid extension in c
V. Comments for CVE-2026-107213
No comments yet