CVE-2026-107220 qax-os CVE debrief

Who should care

Defenders responsible for Go applications using the Excelize library should assess exposure and prioritize verification and remediation efforts. This includes reviewing the library's usage in their applications, identifying potential attack vectors, and implementing measures to prevent exploitation. Additionally, defenders should also consider the potential impact on their organization's Excel file processing and take steps to mitigate any potential risks.

Why it matters

CVE-2026-107220 is a vulnerability in the Excelize library that can cause a panic when handling crafted worksheets. Defenders should prioritize verifying affected versions and applying fixes to prevent potential denial of service and disruption to Excel file processing.

• Denial of service due to panic
• Potential disruption to Excel file processing
• Need for verification of affected versions and application of fixes

Technical summary

The Excelize library is vulnerable to a panic in the cellInRange function when handling an empty mergeCell ref. This occurs when the mergeCellsParser leaves the cached rectangle empty and passes it to cellInRange without a length check. An attacker can craft a worksheet to trigger this panic when a non-streaming cell API reads the worksheet. Defenders should prioritize verifying the affected versions of Excelize and applying the fix as soon as possible to prevent potential denial of service and disruption to Excel file processing.

Defensive priority

Defenders should prioritize verifying the affected versions of Excelize and applying the fix as soon as possible.

Recommended defensive actions

• Verify the version of Excelize being used and update to a fixed version if necessary
• Review and validate input data to prevent crafted worksheets from being processed
• Implement error handling to catch and handle panics caused by the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a lack of length check in the cellInRange function when handling an empty mergeCell ref. This can lead to a panic when a crafted worksheet is read using a non-streaming cell API.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.