Threats tagged 'ghsa-mx22-3794-2vpv'

CVE-2026-107211 is a high-severity vulnerability in the qax-os excelize library involving improper validation of array indices when processing pivot tables in .xlsx files. The vulnerability arises because the library indexes arrays with attacker-controlled integers from pivot table XML parts without bounds checking, leading to runtime panics (index out of range errors). This can cause the host process to crash when opening crafted malicious Excel files containing pivot tables. The issue affects versions from 2.8.1 through 2.11.0. No official patch or fix is currently documented.