CVE-2026-107212 qax-os CVE debrief

Who should care

Defenders responsible for Go language applications using the Excelize library should assess exposure and prioritize verification and patching to prevent potential CPU consumption attacks.

Why it matters

CVE-2026-107212 is a vulnerability in the Excelize library that can cause the GetRows function and the Rows iterator to loop for an extended period, allowing an attacker to consume a CPU core for an attacker-controlled duration. Defenders should prioritize verifying the Excelize library version and applying any available patches or updates to prevent potential CPU consumption attacks.

• An attacker may be able to consume a CPU core for an extended period, potentially leading to denial-of-service conditions.
• Defenders should verify the Excelize library version and apply patches or updates to prevent potential CPU consumption attacks.
• The vulnerability requires verification of the Excelize library version and application of patches or updates to prevent exploitation.

Technical summary

The Excelize library is vulnerable to an unbounded row number issue in the Rows.Columns function, which can cause the GetRows function and the Rows iterator to loop for an extended period, allowing an attacker to consume a CPU core for an attacker-controlled duration. This occurs when the Rows.Columns function accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every

Defensive priority

Defenders should prioritize verifying the Excelize library version and applying any available patches or updates to prevent potential CPU consumption attacks.

Recommended defensive actions

• Verify the Excelize library version and apply any available patches or updates.
• Implement input validation and sanitization to prevent crafted worksheets from being processed.
• Monitor system resources for unusual CPU consumption patterns.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the Rows.Columns function not applying the limit enforced by Rows.Next, allowing an attacker to consume a CPU core for an extended period. This issue arises when a crafted worksheet places an oversized row number after an ordinary valid row. The Excelize library does not properly handle this scenario, leading to potential denial-of-service conditions. Defenders should verify the Excelize library version and apply patches or updates to prevent potential CPU consumption attacks. The vulnerability requires

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.