Excelize EUVD-2026-94526

Exploitation requires an application that (1) embeds excelize 2.8.1-2.11.0, (2) parses an attacker-supplied workbook, and (3) invokes GetPivotTables on it, triggering extractPivotTableFields. The malicious workbook must contain a pivot table with either a pivot-field count mismatch against the pivot-cache field-name slice (getPivotCacheFieldsName output) or an out-of-range/negative dataField 'fld' attribute. LIMITING FACTORS: the vulnerable GetPivotTables code path must actually be reached - services that never process pivot tables are unaffected; and because the panic is unrecovered, impact depends on whether the host process isolates or recovers worker crashes. No authentication or user interaction is required once a crafted file reaches the pivot-table parsing path.

This is a genuine availability-only denial-of-service issue (CWE-129, improper array index validation) in the qax-os/excelize Go library, affecting versions 2.8.1 through 2.11.0. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scoring 8.7 reflects a high availability impact with no confidentiality or integrity impact, consistent with a slice-bounds panic that crashes the process or request worker. The high base score is driven almost entirely by the VA:H availability metric and network reachability - it is NOT a code-execution or data-disclosure flaw, so the headline severity overstates real-world urgency for many deployments. No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, so exploitation-probability and automatability signals cannot be weighed. There is no public exploit identified at time of analysis; the referenced GitHub PR #2435 and commit 6258dce are the vendor FIX (adding bounds checks and a regression test), not weaponized exploit code, and must not be confused with active exploitation. A key practical limiter the CVSS vector does not capture: the panic only triggers in applications that both parse attacker-controlled workbooks AND call GetPivotTables, so AV:N is accurate only for services that expose that code path to untrusted files. Notably, no fixed version is available as of this review, which raises operational risk for affected consumers despite the moderate real impact.

An attacker uploads a crafted .xlsx workbook to a web service or pipeline that uses Excelize and calls GetPivotTables, embedding a pivot table whose dataField 'fld' attribute is out of range or whose pivot-field count mismatches the pivot-cache field-name slice. When the library indexes the field-name slice without bounds checking, Go raises an unrecovered slice-bounds panic that escapes the library and crashes the request worker or entire process, causing denial of service. No public proof-of-concept exploit code was identified, though the vendor's regression test demonstrates the triggering condition.