CVE-2026-107212 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
Attackers can cause excessive CPU consumption in applications using the Excelize library by providing crafted Excel files with oversized row numbers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107212?
CVE-2026-107212 is a high-severity denial of service vulnerability in qax-os excelize, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
Weakness: CWE-770
Which versions are affected by CVE-2026-107212?
4 open source packages ship an affected version, including github.com/xuri/excelize/v2 and github.com/360EntSecGroup-Skylar/excelize/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/xuri/excelize/v2 Go | All versions | 2.11.1-0.20260930021559-01a9ff32fb3c |
github.com/xuri/excelize/v2 Go | From 2.1.0 | 2.11.1-0.20260930021559-01a9ff32fb3c |
github.com/xuri/excelize/v2 Go | From 2.1.0 | 2.11.1-0.20260930021559-01a9ff32fb3c |
github.com/360EntSecGroup-Skylar/excelize/v2 Go | From 2.1.0 | None |
Products include Excelize Excelize.
How do I fix CVE-2026-107212?
Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260930021559-01a9ff32fb3c or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-107212 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107212 exists.
Other vulnerabilities in qax-os excelize
- CVE-2026-107211 Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
- CVE-2026-107213 Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
- CVE-2026-59161 Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
- CVE-2026-107214 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
- CVE-2026-107215 Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
Sources
Also known as GHSA-jw42-f3rr-4cc3, GO-2026-6685.