CVE-2026-107223— Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
Quick assessment
Affected
qax-os excelize
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Excelize 是一个用于读写 Microsoft Excel 电子表格的 Go 语言库。在版本 2.1.0 至 2.11.0 中， 函数在扩展通过文件加载的列范围时，未对 和 值与工作表列数上限进行验证。 函数会调用 ，从而在不强制执行最大列数限制的情况下，将 和 进行扩展。当构造的工作表提供过大的列最大属性值，且应用程序调用列修改器时， 会对每个攻击者指定的列号执行深度拷贝和追加操作，导致攻击者可消耗过多的 CPU 和内存资源，或引发内存溢出（OOM）。截至本次审查，尚无可用修复版本。
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107223
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
Source: CVE Program / CVE List V5
Vulnerability Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-107223
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107223
请登录查看更多情报信息。
Other References for CVE-2026-107223 (3)
-
https://github.com/qax-os/excelize/pull/2370 x_refsource_MISC
-
https://github.com/qax-os/excelize/security/advisories/GHSA-fq3v-74gv-27gm x_refsource_CONFIRM
Same Patch Batch · qax-os · 2026-10-07 · 15 CVEs total
| CVE-2026-107211 | 8.7 HIGH | Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverabl |
| CVE-2026-107213 | 8.7 HIGH | Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no |
| CVE-2026-107212 | 7.5 HIGH | Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop fo |
| CVE-2026-107214 | 7.5 HIGH | Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks |
| CVE-2026-107216 | 7.5 HIGH | Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entra |
| CVE-2026-107215 | 7.5 HIGH | Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers |
| CVE-2026-107217 | 7.5 HIGH | Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil er |
| CVE-2026-107219 | 7.5 HIGH | Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile |
| CVE-2026-107220 | 6.5 MEDIUM | Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref |
| CVE-2026-107221 | 6.5 MEDIUM | Excelize: a row whose earlier cell has a higher column reference than its last cell panics |
| CVE-2026-107222 | 6.5 MEDIUM | Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no l |
| CVE-2026-107225 | 6.5 MEDIUM | Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml |
| CVE-2026-107224 | 6.5 MEDIUM | Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader |
| CVE-2026-107218 | 5.3 MEDIUM | Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics |
IV. Related Vulnerabilities
Same product: excelize
-
CVE-2026-107225
Excelize: GetStyle panics on a negative fillId, borderId or -
CVE-2026-107224
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/ -
CVE-2026-107222
Excelize: GetConditionalFormats indexes conditional-formatti -
CVE-2026-107221
Excelize: a row whose earlier cell has a higher column refer -
CVE-2026-107220
Excelize: Panic in cellInRange on a worksheet with an empty
Same vendor: qax-os
-
CVE-2026-107225
Excelize: GetStyle panics on a negative fillId, borderId or -
CVE-2026-107224
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/ -
CVE-2026-107222
Excelize: GetConditionalFormats indexes conditional-formatti -
CVE-2026-107221
Excelize: a row whose earlier cell has a higher column refer -
CVE-2026-107220
Excelize: Panic in cellInRange on a worksheet with an empty
Same weakness: CWE-789
-
CVE-2026-107215
Excelize: extractPart allocates attacker-controlled, unbound -
CVE-2026-106453
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unv -
CVE-2026-106452
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidate -
CVE-2026-103005
Memory Allocation with Excessive Size Value in Elasticsearch -
CVE-2026-106114
ImageSharp: ICC CLUT parsing allocates from unvalidated chan
V. Comments for CVE-2026-107223
No comments yet