CVE-2026-107217— Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
Quick assessment
Affected
qax-os excelize
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Excelize 是一个用于读取和写入 Microsoft Excel 电子表格的 Go 语言库。在 github.com/xuri/excelize/v2 的 2.0.0 至 2.11.0 版本，以及 github.com/xuri/excelize 的 1.1.0 至 1.4.1 版本中， 函数在计算双射 26 进制数值时使用了 类型，但未对溢出进行检查，导致过长的列名会无声地回绕（wrap）为零，而不会抛出错误。例如， 接受溢出列名 "VGWQHXLSDVIKWV"，其计算结果回绕为零。随后， 和 函数会使用
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107217
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
Source: CVE Program / CVE List V5
Vulnerability Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column name to wrap to zero with no error. ColumnNameToNumber accepts the overflowing name VGWQHXLSDVIKWV, after which checkSheetR0 and xlsxWorksheet.checkRow use the wrapped column value as an index. When a crafted worksheet uses an overflowing column name in a row normalized by checkSheetR0 or checkRow, the wrapped zero column becomes a negative slice index during worksheet normalization, allowing an attacker to panic and terminate the calling process. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-107217
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107217
请登录查看更多情报信息。
Other References for CVE-2026-107217 (3)
-
https://github.com/qax-os/excelize/pull/2394 x_refsource_MISC
-
https://github.com/qax-os/excelize/security/advisories/GHSA-c85p-xxjj-2r75 x_refsource_CONFIRM
Same Patch Batch · qax-os · 2026-10-07 · 15 CVEs total
| CVE-2026-107211 | 8.7 HIGH | Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverabl |
| CVE-2026-107213 | 8.7 HIGH | Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no |
| CVE-2026-107212 | 7.5 HIGH | Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop fo |
| CVE-2026-107214 | 7.5 HIGH | Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks |
| CVE-2026-107216 | 7.5 HIGH | Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entra |
| CVE-2026-107215 | 7.5 HIGH | Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers |
| CVE-2026-107219 | 7.5 HIGH | Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile |
| CVE-2026-107223 | 7.1 HIGH | Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded pe |
| CVE-2026-107220 | 6.5 MEDIUM | Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref |
| CVE-2026-107221 | 6.5 MEDIUM | Excelize: a row whose earlier cell has a higher column reference than its last cell panics |
| CVE-2026-107222 | 6.5 MEDIUM | Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no l |
| CVE-2026-107225 | 6.5 MEDIUM | Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml |
| CVE-2026-107224 | 6.5 MEDIUM | Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader |
| CVE-2026-107218 | 5.3 MEDIUM | Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics |
IV. Related Vulnerabilities
Same product: excelize
-
CVE-2026-107225
Excelize: GetStyle panics on a negative fillId, borderId or -
CVE-2026-107224
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/ -
CVE-2026-107223
Excelize: Unbounded <col max> attribute is loaded with no Ma -
CVE-2026-107222
Excelize: GetConditionalFormats indexes conditional-formatti -
CVE-2026-107221
Excelize: a row whose earlier cell has a higher column refer
Same vendor: qax-os
-
CVE-2026-107225
Excelize: GetStyle panics on a negative fillId, borderId or -
CVE-2026-107224
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/ -
CVE-2026-107223
Excelize: Unbounded <col max> attribute is loaded with no Ma -
CVE-2026-107222
Excelize: GetConditionalFormats indexes conditional-formatti -
CVE-2026-107221
Excelize: a row whose earlier cell has a higher column refer
Same weakness: CWE-190
-
CVE-2026-107224
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/ -
CVE-2026-106571
ImageMagick: Heap Buffer Over-Write in GetVirtualPixels api -
CVE-2026-59346
VMware Workstation and Fusion VMXNET3 integer-overflow vulne -
CVE-2026-106417
Chrome <155.0.8059.39 整数溢出漏洞 -
CVE-2026-106332
Chrome < 155.0.8059.39 跨源数据泄露漏洞
V. Comments for CVE-2026-107217
No comments yet