Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107213 · Microsoft / collected KEV context

EUVD-2026-94530

GHSA-r7x5-4969-99p7

GO-2026-6687

cve-program · CVE-2026-107213

• https://github.com/qax-os/excelize/security/advisories/GHSA-r7x5-4969-99p7
• https://github.com/qax-os/excelize/pull/2434
• https://github.com/qax-os/excelize/commit/8ffeb07ec9a350410f6922313f6b7e4f5cc79241

euvd · EUVD-2026-94530

• https://github.com/qax-os/excelize/security/advisories/GHSA-r7x5-4969-99p7
• https://github.com/qax-os/excelize/pull/2434
• https://github.com/qax-os/excelize/commit/8ffeb07ec9a350410f6922313f6b7e4f5cc79241

nvd · CVE-2026-107213

• https://github.com/qax-os/excelize/commit/8ffeb07ec9a350410f6922313f6b7e4f5cc79241
• https://github.com/qax-os/excelize/pull/2434
• https://github.com/qax-os/excelize/security/advisories/GHSA-r7x5-4969-99p7

osv · GHSA-r7x5-4969-99p7

• https://github.com/qax-os/excelize/security/advisories/GHSA-r7x5-4969-99p7
• https://nvd.nist.gov/vuln/detail/CVE-2026-107213
• https://github.com/qax-os/excelize/pull/2434
• https://github.com/qax-os/excelize/commit/8ffeb07ec9a350410f6922313f6b7e4f5cc79241
• https://github.com/qax-os/excelize

osv · GO-2026-6687

• https://github.com/qax-os/excelize/security/advisories/GHSA-r7x5-4969-99p7
• https://github.com/qax-os/excelize/commit/8ffeb07ec9a350410f6922313f6b7e4f5cc79241
• https://github.com/qax-os/excelize/pull/2434

No related operational record is retained in the current change model.