CVE-2026-107223: Qax-OS Excelize

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxColumns. When a crafted worksheet supplies an oversized col max attribute and the application invokes a column mutator, flatCols performs a deep copy and append for every attacker-selected column number, allowing an attacker to consume excessive CPU and memory or trigger OOM. No fixed version is available as of this review.

Affected products

• Qax-OS Excelize: from 2.1.0, up to and including 2.11.0

Published 2026-10-07. Last modified 2026-10-08.