Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107212 · Microsoft / collected KEV context

EUVD-2026-94527

GHSA-jw42-f3rr-4cc3

GO-2026-6685

cve-program · CVE-2026-107212

• https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3
• https://github.com/qax-os/excelize/pull/2438
• https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23

euvd · EUVD-2026-94527

• https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3
• https://github.com/qax-os/excelize/pull/2438
• https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23

nvd · CVE-2026-107212

• https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23
• https://github.com/qax-os/excelize/pull/2438
• https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3

osv · GHSA-jw42-f3rr-4cc3

• https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3
• https://nvd.nist.gov/vuln/detail/CVE-2026-107212
• https://github.com/qax-os/excelize/pull/2438
• https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23
• https://github.com/qax-os/excelize

osv · GO-2026-6685

• https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3
• https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23
• https://github.com/qax-os/excelize/pull/2438

No related operational record is retained in the current change model.