CVE-2026-107217 Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
An integer overflow in Excelize allows attackers to cause a denial of service via crafted spreadsheet files triggering a panic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107217?
CVE-2026-107217 is a high-severity vulnerability in qax-os excelize, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column name to wrap to zero with no error. ColumnNameToNumber accepts the overflowing name VGWQHXLSDVIKWV, after which checkSheetR0 and xlsxWorksheet.checkRow use the wrapped column value as an index. When a crafted worksheet uses an overflowing column name in a row normalized by checkSheetR0 or checkRow, the wrapped zero column becomes a negative slice index during worksheet normalization, allowing an attacker to panic and terminate the calling process. No fixed version is available as of this review.
Which versions are affected by CVE-2026-107217?
4 open source packages ship an affected version, including github.com/xuri/excelize and github.com/xuri/excelize/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/xuri/excelize Go | From 1.1.0 to 1.4.1 | None |
github.com/xuri/excelize Go | From 1.1.0 to 1.4.1 | None |
github.com/xuri/excelize/v2 Go | From 2.0.0 | 2.11.1-0.20260910071107-696050fbf14e |
github.com/xuri/excelize/v2 Go | From 2.0.0 | 2.11.1-0.20260910071107-696050fbf14e |
Products include Excelize Excelize.
How do I fix CVE-2026-107217?
No fix published yet.
Is CVE-2026-107217 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107217 exists.
Other vulnerabilities in qax-os excelize
- CVE-2026-107211 Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
- CVE-2026-107213 Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
- CVE-2026-59161 Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
- CVE-2026-107212 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
- CVE-2026-107214 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
Sources
Also known as GHSA-c85p-xxjj-2r75.