Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Qax Os
Excelize

qax-os/excelize: Functions Patched by CVE Fixes

go

#324 of 500 repositories

qax-os/excelize

Functions and files changed by CVE fixes in this repository.

Latest located fix October 7, 2026

17

CVE fixes located

Published CVEs

29

Functions patched

Distinct function sites

11

Files patched

Distinct source files

2026

Years covered

By CVE publication date

Overview

17 published CVEs have a fix traced to functions in qax-os/excelize, the earliest published in 2026. Those fixes changed 29 distinct functions across 11 files, in 204 patch hunks.

Among the 500 repositories tracked here, qax-os/excelize ranks #324 by the number of CVEs with a located fix.

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References

Most patched functions

Functions in qax-os/excelize changed by the most CVE fixes.

1Nextrows.go3 CVEs · 4 patches2026
2convertPasswdToKeycrypt.go2 CVEs · 4 patches2026
3Closerows.go2 CVEs · 2 patches2026
4Unlockcell.go2 CVEs · 2 patches2026
5newInvalidSharedStringIndexerrors.go2 CVEs · 2 patches2026
6lenstyles.go1 CVEs · 2 patches2026
7ReadZipReaderlib.go1 CVEs · 2 patches2026
8checkFileSizelib.go1 CVEs · 2 patches2026
9flatColscol.go1 CVEs · 2 patches2026
10extractCondFmtDataBarstyles.go1 CVEs · 2 patches2026
11extractCondFmtColorScalestyles.go1 CVEs · 2 patches2026
12extractCondFmtCellIsstyles.go1 CVEs · 2 patches2026
13checkRowrows.go1 CVEs · 2 patches2026
14mergeCellsParsercell.go1 CVEs · 2 patches2026
15leftRightcalc.go1 CVEs · 2 patches2026

Most patched files

Files in qax-os/excelize changed by the most CVE fixes.

1rows.go4 CVEs · 4 functions
2crypt.go3 CVEs · 9 functions
3cell.go3 CVEs · 2 functions
4errors.go3 CVEs · 1 functions
5lib.go2 CVEs · 4 functions
6styles.go2 CVEs · 4 functions
7calc.go2 CVEs · 2 functions
8col.go1 CVEs · 1 functions
9pivotTable.go1 CVEs · 1 functions
10slicer.go1 CVEs · 1 functions

Fix size

How much code a CVE fix in qax-os/excelize changes, with backports counted once.

22

Median lines changed

Added plus removed, per CVE

41%

Fixes of 20 lines or fewer

Share of CVE fixes

47%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in qax-os/excelize, and the functions each fix changed.

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml
CVE-2026-107225len
Medium · CVSS 6.5
EPSS 0.3%2026-10-07
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader
CVE-2026-107224checkFileSize ReadZipReader
Medium · CVSS 6.5
EPSS 0.3%2026-10-07
Excelize: Unbounded attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
CVE-2026-107223flatCols
High · CVSS 7.1
EPSS 0.3%2026-10-07
Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
CVE-2026-107222extractCondFmtColorScale extractCondFmtCellIs extractCondFmtDataBar
Medium · CVSS 6.5
EPSS 0.3%2026-10-07
Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
CVE-2026-107221checkRow
Medium · CVSS 6.5
EPSS 0.3%2026-10-07
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
CVE-2026-107220mergeCellsParser
Medium · CVSS 6.5
EPSS 0.2%2026-10-07
Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
CVE-2026-107219convertPasswdToKey
High · CVSS 7.5
EPSS 0.3%2026-10-07
Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics
CVE-2026-107218leftRight
Medium · CVSS 5.3
EPSS 0.3%2026-10-07
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
CVE-2026-107217JoinCellName ColumnNameToNumber
High · CVSS 7.5
EPSS 0.3%2026-10-07
Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
CVE-2026-107216ANCHORARRAY
High · CVSS 7.5
EPSS 0.3%2026-10-07
Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
CVE-2026-107215extractPart Decrypt
High · CVSS 7.5
EPSS 0.2%2026-10-07
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
CVE-2026-107214agileDecrypt standardDecrypt createIV
High · CVSS 7.5
EPSS 0.2%2026-10-07

Get an alert for each new qax-os/excelize CVE, with the patched functions and AI-written analysis.

Monitor excelize CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

alkacon/opencms-core17 CVEs apache/zeppelin17 CVEs cgit.ghostscript.com/cgi-bin-cgit.cgi-ghostpdl17 CVEs ChurchCRM/CRM17 CVEs coturn/coturn17 CVEs cure53/DOMPurify17 CVEs debian/gnutls2817 CVEs debian/xen17 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in qax-os/excelize.

How many CVEs have a located fix in qax-os/excelize?: 17 published CVEs have a fix traced to functions in qax-os/excelize, touching 29 functions across 11 files.
Which function in qax-os/excelize has been patched by the most CVEs?: Next in rows.go has been changed by 3 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in qax-os/excelize?: The median fix changes 22 lines. 41% of fixes change 20 lines or fewer, and 47% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

qax-os/excelize on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track qax-os/excelize CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing