Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-107221
qax-os excelize — Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N R U N N H 6.5 .0027 17.9 —
AFFECTED
Product Versions Fixed
excelize >= 2.0.0, <= 2.11.0 – —
TIMELINE
Oct 7 Reserved by GitHub_M
Oct 7 Published (CNA: GitHub_M)
Oct 13 EXPLOIT PUBLISHED — CVE-2026-107221 (qax-os excelize). Public exploit reference added.
Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and checkRow, where targetList is too short for an earlier out-of-order cell. When a crafted row places a higher-column cell before a lower-column final cell and a non-streaming worksheet API reads the sheet, the earlier cell's column index exceeds the slice length derived from the final cell, allowing an attacker to cause an unrecovered panic and terminate the process. No fixed version is available as of this review.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| October 7, 2026 | Reserved | Reserved by GitHub_M |
| October 7, 2026 | Published | Published (CNA: GitHub_M) |
| October 13, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-107221 (qax-os excelize). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| qax-os | excelize | — | >= 2.0.0, <= 2.11.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-107221 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
