ColumnNameToNumber in Excelize increments a base‑26 value stored in an int64 without checking for overflow. When given an excessively long column name such as VGWQHXLSDVIKWV, the value wraps to zero and the library returns a nil error. Subsequent code in checkSheetR0 and xlsxWorksheet.checkRow interprets this wrapped value as a column index. In a normal worksheet, this produces a negative slice index during normalization, causing a runtime panic that terminates the owning process. The vulnerability is a typical integer overflow leading to a panic; it does not allow arbitrary code execution or information disclosure.

The affected vendor is qax-os, providing the excelize Go library. Versions from 2.0.0 through 2.11.0 of github.com/xuri/excelize/v2 and from 1.1.0 through 1.4.1 of github.com/xuri/excelize are impacted. No patched release is currently available, so all installations within those ranges are vulnerable.

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score is not available, suggesting that the exploit probability is unknown but the vulnerability remains noteworthy. The vulnerability is not listed in CISA’s KEV catalog, meaning publicly known exploits have not yet been confirmed. The likely attack vector is an attacker supplying a crafted Excel file with an overly long column name to a system that uses excelize to process user input. Upon loading the file, the library will panic, causing a denial of service. No additional prerequisites are required beyond the vulnerable library being in use and processing the attacker‑controlled file.