Threats tagged 'ghsa-fw94-4wwp-w8pw'

CVE-2026-107224 is an integer overflow vulnerability in the qax-os excelize library affecting versions from 2.1.0 through 2.11.0. It arises from improper handling of Zip64 uncompressed sizes that, when set to values with the high bit set, cast to negative int64 values. This bypasses unzip size guards and leads to a panic due to a negative capacity passed to Go's make function, causing a runtime error and crashing the calling goroutine. The vulnerability can be triggered by a crafted 159-byte archive without authentication.