CVE-2026-107211: CWE-129: Improper Validation of Array Index in qax-os excelize

The vulnerability in qax-os excelize (versions 2.8.1 to 2.11.0) arises from improper validation of array indices (CWE-129) during pivot-table processing. Specifically, separately parsed pivot-table field indices are used without bounds checking to index the pivot-cache field-name slice. The function extractPivotTableFields uses output from getPivotCacheFieldsName and trusts the dataField fld attribute as a valid index. If a crafted workbook supplies a pivot-field count mismatch or an out-of-range dataField fld value before GetPivotTables is called, this unchecked index access triggers a Go slice-bounds panic. This panic escapes the library, allowing an attacker to crash the process or request worker using the library.

An attacker can cause a denial-of-service condition by crashing the process or request worker that uses the vulnerable excelize library. This is achieved by supplying a specially crafted Excel workbook that triggers an out-of-bounds slice access, resulting in a runtime panic. There is no indication of code execution or data corruption beyond process crash. No known exploits are reported in the wild.

No fixed version is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates and patches. Until a fix is released, avoid processing untrusted or malicious Excel files with the affected versions of the excelize library to reduce risk.