CVE-2026-107218: CWE-129: Improper Validation of Array Index in qax-os excelize
Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review.
CVSS v3.1
Score 5.3medium
Affected software
qax-os
excelize
pkg:golang/github.com/qax-os/excelizeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Excelize, a Go library for handling Excel spreadsheets, has an improper validation of array index vulnerability (CWE-129) in versions 2.10.1 to 2.11.0. The RIGHT function validates requested substring lengths using UTF-16 code-unit counts but slices rune arrays using Unicode code-point counts. This inconsistency can produce a negative index when processing supplementary-plane Unicode characters, causing the program to panic during formula evaluation. The issue is triggered through the CalcCellValue function. No patched version is available as of the latest review.
Potential Impact
The vulnerability can cause the application using the excelize library to panic (crash) during formula evaluation when processing certain Unicode characters. This results in a denial of service condition but does not impact confidentiality, integrity, or allow code execution. There are no known exploits in the wild.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, avoid processing untrusted Excel files that may trigger the vulnerable RIGHT function with supplementary-plane Unicode characters.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-07T14:34:14.816Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac694282cdf04f65671beac
Added to database: 10/07/2026, 18:49:12 UTC
Last enriched: 10/07/2026, 19:05:53 UTC
Last updated: 10/07/2026, 22:34:01 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.