Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-107217
qax-os excelize — Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U N N H 7.5 .0034 25.7 —
AFFECTED
Product Versions Fixed
excelize >= 2.0.0, <= 2.11.0 – —
TIMELINE
Oct 7 Reserved by GitHub_M
Oct 7 Published (CNA: GitHub_M)
Oct 13 EXPLOIT PUBLISHED — CVE-2026-107217 (qax-os excelize). Public exploit reference added.
Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column name to wrap to zero with no error. ColumnNameToNumber accepts the overflowing name VGWQHXLSDVIKWV, after which checkSheetR0 and xlsxWorksheet.checkRow use the wrapped column value as an index. When a crafted worksheet uses an overflowing column name in a row normalized by checkSheetR0 or checkRow, the wrapped zero column becomes a negative slice index during worksheet normalization, allowing an attacker to panic and terminate the calling process. No fixed version is available as of this review.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| October 7, 2026 | Reserved | Reserved by GitHub_M |
| October 7, 2026 | Published | Published (CNA: GitHub_M) |
| October 13, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-107217 (qax-os excelize). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| qax-os | excelize | — | >= 2.0.0, <= 2.11.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-107217 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
