Threats tagged 'ghsa-fq3v-74gv-27gm'

CVE-2026-107223 is a high-severity vulnerability in the qax-os excelize Go library for handling Microsoft Excel spreadsheets. Versions from 2.1.0 through 2.11.0 are affected. The flaw arises because the library's flatCols function expands column ranges without validating the Min and Max column indices against the worksheet's column limit. An attacker can craft a worksheet with an excessively large column max attribute, causing the library to allocate excessive memory and CPU during column mutation operations, potentially leading to out-of-memory conditions. No official fix or patch is currently available.