CVE-2026-107224: CWE-190: Integer Overflow or Wraparound in qax-os excelize
Description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.
CVSS v3.1
Score 6.5medium
Affected software
qax-os
excelize
pkg:golang/github.com/qax-os/excelizeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Excelize is a Go library for handling Microsoft Excel files. Versions 2.1.0 to 2.11.0 contain an integer overflow issue where a Zip64 uncompressed size with the high bit set (values from 2^63 to 2^64-1) is converted from an unsigned 64-bit integer to a negative signed 64-bit integer before size checks and memory allocation. This causes the negative size to bypass unzip limits and results in a negative capacity passed to the make function, leading to a panic when opening a maliciously crafted workbook. No patch or fix has been released as of the latest review.
Potential Impact
The vulnerability can cause a denial of service by triggering a panic during workbook opening, impacting availability. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.
Mitigation Recommendations
No official fix or patch is currently available. Users should avoid opening untrusted or suspicious Excel files created with malicious Zip64 entries until a fix is released. Monitor vendor advisories for updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-07T14:34:14.816Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac697a62cdf04f65673ff41
Added to database: 10/07/2026, 19:04:06 UTC
Last enriched: 10/07/2026, 19:18:26 UTC
Last updated: 10/07/2026, 20:04:34 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.