CVE-2026-107213 qax-os CVE debrief

Who should care

Defenders responsible for Go applications using the Excelize library, particularly those handling Excel files from untrusted sources, should assess exposure and prioritize verification and mitigation.

Why it matters

CVE-2026-107213 is a vulnerability in the Excelize library that can cause a nil-pointer dereference in the GetSlicers function, potentially leading to a panic and termination of an unprotected process. Defenders should prioritize verifying the affected versions and applying fixes or mitigations to prevent exploitation.

• Potential panic and termination of an unprotected process.
• Possible denial of service (DoS) due to process termination.
• Need for verification of affected versions and application of fixes or mitigations.

Technical summary

The GetSlicers function in Excelize checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. This can be triggered by a crafted worksheet containing an extLst element without a drawing element, causing a nil-pointer dereference and potentially leading to a panic and termination of an unprotected process. The vulnerability affects Excelize versions from 2.9.0 to 2.11.0. Defenders should prioritize verifying the affected versions and applying fixes or mitigations to prevent exploitation.

Defensive priority

Defenders should prioritize verifying the affected versions of Excelize and applying a fix or mitigation to prevent exploitation.

Recommended defensive actions

• Verify the version of Excelize being used and check if it is within the affected range (2.9.0 to 2.11.0).
• Apply a fix or mitigation to prevent exploitation, if available.
• Monitor for any updates or patches from the vendor.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the GetSlicers function checking for ExtLst but dereferencing ws.Drawing without checking whether the independently optional drawing element exists. This can be triggered by a crafted worksheet containing an extLst element without a drawing element.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.