CVE-2026-107214: CWE-248: Uncaught Exception in qax-os excelize

Excelize is a Go library for handling Microsoft Excel spreadsheets. Versions from 2.3.1 to 2.11.0 contain a vulnerability where the decryption dispatch does not sufficiently validate structural and parameter data before passing it to standard and agile decryptors. Specifically, attacker-controlled EncryptionInfo and EncryptedPackage data are processed without proper validation, allowing malformed OLE compound files with valid versioned EncryptionInfo streams to trigger nine classes of unrecovered Go runtime panics. These panics cause the calling process to terminate, representing a denial-of-service condition. No fixed version is available as of the latest review.

An attacker can craft a malformed encrypted Excel file that triggers unrecovered runtime panics in the excelize library during decryption. This results in the termination of the calling process, causing a denial-of-service (DoS) impact. There is no indication of confidentiality or integrity compromise. No known exploits are reported in the wild.

No official fix or patch is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, avoid processing untrusted or malformed encrypted Excel files with affected versions of the excelize library to mitigate risk.