# CVE-2026-107211: Excelize unchecked pivot-cache field index bounds in extractPivotTableFields

Source: https://junglewise.ai/threats/cve-2026-107211-excelize-unchecked-pivot-cache-field-index-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107211 · Severity: high · CVSS 4 · Published 2026-10-08

Excelize is a Go library for reading and writing Excel files. An attacker can craft a malicious Excel workbook with mismatched pivot table and pivot cache field definitions that causes the library to crash with an unrecovered panic when processing the file. This enables a denial-of-service attack against any service that opens untrusted Excel files and accesses their pivot tables.

Technologies: [github.com/xuri/excelize/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-xuri-excelize-v2), [Xuri Excelize](https://junglewise.ai/threats/technologies/excelize). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Xuri](https://junglewise.ai/threats/vendors/xuri).

## Quick answers

**Is CVE-2026-107211 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107211 being exploited in the wild.

**How severe is CVE-2026-107211?** High severity, with a CVSS score of 4, published 8 October 2026.

**Which products and versions are affected?** github.com/xuri/excelize/v2 (Go) >= 2.8.1, < 2.11.1-0.20261003002531-6258dcebc4e2, SEMVER:introduced=2.8.1,fixed=2.11.1-0.20261003002531-6258dcebc4e2; Xuri Excelize prior to fix.

**Is there a fix for CVE-2026-107211?** Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20261003002531-6258dcebc4e2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107211 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107211?** Check whether you run github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20261003002531-6258dcebc4e2 or later

  ```sh
  go get github.com/xuri/excelize/v2@v2.11.1-0.20261003002531-6258dcebc4e2
  ```


## Technical details

The extractPivotTableFields function in pivotTable.go indexes a pivot cache fields array (order) without validating bounds against values from separately-parsed pivot table XML: field indices are taken directly from the untrusted int attribute fld="N" in dataField elements, and fieldIdx loop counters over pt.PivotFields.PivotField are used to index order without confirming the counts match. An attacker can set fld to an out-of-range value or truncate cache field definitions to trigger index-out-of-range panics at lines 1431, 1434, 1437, or 1443. The Go runtime does not recover these panics, terminating the host process.

## Affected products

- xuri Excelize prior to fix

## Identifiers

- CVE-2026-107211
- GHSA-mx22-3794-2vpv
- GO-2026-6695

## Timeline

- 2026-10-08: disclosed

## Related threats

- [Excelize unbounded row iteration denial of service](https://junglewise.ai/threats/cve-2026-107212-excelize-unbounded-row-number-in-rows-columns-makes-getrows-and)
- [Excelize nil-pointer dereference in GetSlicers](https://junglewise.ai/threats/cve-2026-107213-excelize-nil-pointer-dereference-in-getslicers-when-a-worksheet)
- [Excelize Decrypt panic on malformed OLE encrypted workbooks](https://junglewise.ai/threats/cve-2026-107214-excelize-decrypt-unrecoverable-panics-on-malformed-ole-cfb)
- [Excelize extractPart unbounded buffer allocation DoS](https://junglewise.ai/threats/cve-2026-107215-excelize-extractpart-allocates-attacker-controlled-unbounded-and)
- [Excelize ANCHORARRAY mutually-referencing formulas stack overflow](https://junglewise.ai/threats/cve-2026-107216-excelize-anchorarray-mutually-referencing-array-formulas-recurse)