CVE-2026-107211 qax-os CVE debrief

Who should care

Defenders responsible for maintaining and securing systems that utilize the Excelize library should be aware of this vulnerability and take necessary actions to prevent potential crashes or worker requests.

Why it matters

CVE-2026-107211 is a vulnerability in the Excelize library that can cause process crashes or worker requests. Defenders should verify the library version, apply patches, and validate user-supplied workbooks to prevent exploitation.

• Potential process crashes or worker requests due to unchecked pivot-cache field indices
• Need for verification of Excelize library version and application of available patches
• Importance of validating user-supplied workbooks for potential pivot-field count mismatches or out-of-range dataField fld values

Technical summary

The Excelize library, used for reading and writing Microsoft Excel spreadsheets in Go, is vulnerable to an unchecked pivot-cache field index in the extractPivotTableFields function. This occurs because separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. An attacker can exploit this by supplying a crafted workbook with a pivot-field count mismatch or an out-of-range dataField fld value, causing a Go slice-bounds panic that escapes the library. This allows the attacker to crash the process or request worker. Defenders should prioritize verifying the Excelize library version and applying any available patches to prevent potential crashes or worker  

Defensive priority

Defenders should prioritize verifying the Excelize library version and applying any available patches to prevent potential crashes or worker requests.

Recommended defensive actions

• Verify the Excelize library version and apply any available patches
• Validate user-supplied workbooks for potential pivot-field count mismatches or out-of-range dataField fld values
• Implement bounds checks when indexing the pivot-cache field-name slice
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a lack of bounds checks when indexing the pivot-cache field-name slice. This can be exploited by supplying a crafted workbook with a pivot-field count mismatch or an out-of-range dataField fld value.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.