CVE-2026-107218 qax-os CVE debrief

Who should care

Defenders responsible for systems and applications that use the Excelize library should assess exposure and prioritize verification and mitigation to prevent potential panics during formula evaluation.

Why it matters

CVE-2026-107218 is a vulnerability in the Excelize library that can cause a panic during formula evaluation when the RIGHT() function is used on supplementary-plane text slices with a negative index. Defenders should prioritize verifying the Excelize library version and applying a fix or mitigation to prevent potential panics.

• Verification of Excelize library version is required to determine exposure.
• Potential panics during formula evaluation could lead to system instability or crashes.
• Defenders should prioritize applying a fix or mitigation to prevent potential panics.

Technical summary

The vulnerability occurs when the RIGHT() function is used on supplementary-plane text slices with a negative index, causing a panic during formula evaluation in the Excelize library, which is a Go language library for reading and writing Microsoft Excel spreadsheets. The vulnerability affects versions 2.10.1 to 2.11.0 of the Excelize library. This inconsistency can produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. Defenders should prioritize verifying the Excelize library version and applying a fix or mitigation to prevent potential panics during formula evaluation. The RIGHT() function validates the requested length with UTF-16 code-unit counts but slices a rune

Defensive priority

Defenders should prioritize verifying the Excelize library version and applying a fix or mitigation to prevent potential panics during formula evaluation.

Recommended defensive actions

• Verify the Excelize library version and apply a fix or mitigation to prevent potential panics during formula evaluation.
• Review and update affected systems and applications that use the Excelize library.
• Monitor for potential exploitation attempts and anomalies in system logs.
• Perform a thorough review of system logs to identify potential exploitation attempts.
• Update asset inventory to track systems and applications that use the Excelize library.
• Implement compensating controls to prevent potential panics during formula evaluation.
• Review and update change management processes to ensure timely application of vendor patches.

Evidence notes

The vulnerability is caused by inconsistent units used in the RIGHT() function, which validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. This inconsistency can produce a negative rune-slice index, allowing an attacker to panic during formula evaluation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.