CVE-2026-107211

Name of the Vulnerable Software and Affected Versions Excelize versions 2.8.1 through 2.11.0

Description This issue occurs when separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. The extractPivotTableFields function uses the output of getPivotCacheFieldsName while processing GetPivotTables and trusts the fld attribute of dataField as an index. If a crafted workbook provides a pivot-field count mismatch or an out-of-range fld value before GetPivotTables is called, it triggers a Go slice-bounds panic. This allows an attacker to crash the process or the request worker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.