{"id":"EUVD-2026-94554","enisaUuid":"57345f41-8ca7-3bbd-8bb1-2cc07e3c2e26","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review.","datePublished":"Oct 7, 2026, 6:48:54 PM","dateUpdated":"Oct 7, 2026, 10:05:27 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-fq3v-74gv-27gm\nhttps://github.com/qax-os/excelize/pull/2370\nhttps://github.com/qax-os/excelize/commit/a54c578af309fa81f448143ed2b7a91192cc58a7\n","aliases":"CVE-2026-107223\nGHSA-fq3v-74gv-27gm\n","assigner":"GitHub_M","epss":0.37,"enisaIdProduct":[{"id":"45ecae41-88a0-3b3e-a46e-e96d4728fdae","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"2.1.0, ≤ 2.11.0"}],"enisaIdVendor":[{"id":"77c7ffd9-7145-38b0-b7ce-30e90e69cb53","vendor":{"name":"qax-os"}}],"enisaIdVulnerability":[{"id":"1bde701b-0d6e-3ddd-bb0a-4758d26e35a7","vulnerability":{"id":"CVE-2026-107223","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review.","datePublished":"Oct 7, 2026, 6:48:54 PM","dateUpdated":"Oct 7, 2026, 10:05:27 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-fq3v-74gv-27gm\nhttps://github.com/qax-os/excelize/pull/2370\nhttps://github.com/qax-os/excelize/commit/a54c578af309fa81f448143ed2b7a91192cc58a7\n","enisa_id":"EUVD-2026-94554\n","assigner":"GitHub_M","epss":0.37,"dataProcessed":"Oct 27, 2026, 7:16:54 AM","vulnerabilityProduct":[{"id":"5030d686-ae25-372f-adf8-6169cf451a73","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"2.1.0, ≤ 2.11.0"}],"vulnerabilityVendor":[{"id":"ae033bc3-66c9-3a6d-99b0-41328bd28b2f","vendor":{"name":"qax-os"}}]}},{"id":"f9f07a14-532e-31c0-97ac-d831d336c6fa","vulnerability":{"id":"GHSA-fq3v-74gv-27gm","description":"Excelize: Unbounded \u003ccol max\u003e attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process","datePublished":"Oct 7, 2026, 8:22:49 PM","dateUpdated":"Oct 7, 2026, 8:22:49 PM","baseScore":0.0,"references":"https://github.com/qax-os/excelize/security/advisories/GHSA-fq3v-74gv-27gm\nhttps://github.com/qax-os/excelize/pull/2370\nhttps://github.com/qax-os/excelize/commit/a54c578af309fa81f448143ed2b7a91192cc58a7\nhttps://github.com/qax-os/excelize\n","enisa_id":"EUVD-2026-94554\n","aliases":"CVE-2026-107223\nGHSA-fq3v-74gv-27gm\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}