Excelize, a Go library for reading and writing Microsoft Excel spreadsheets, contains a bug in its RIGHT() function. The function verifies the requested length against UTF‑16 code‑unit counts but performs slicing using Unicode code‑point counts. When the input contains supplementary‑plane characters, the mismatch can produce a negative slice index. This causes a panic during formula evaluation, which terminates the application and results in a denial of service. The vulnerability is rated a moderate CVSS score of 5.3, indicating that it can lead to application downtime if exploited but does not allow arbitrary code execution or data exfiltration.

The issue affects qax‑os Excelize versions 2.10.1 through 2.11.0, the releases that introduced the mismatch in the RIGHT() implementation. No fixed version is available as of this review, so all installations within that range are vulnerable.

The CVSS score of 5.3 classifies the vulnerability as moderate. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a maliciously crafted spreadsheet that contains supplementary‑plane characters and is processed by an application using Excelize to evaluate formulas. Based on the description, it is inferred that an attacker could place such a spreadsheet in an environment where files are automatically parsed, triggering the panic and causing a service interruption. No public exploit has been reported, but the deterministic nature of the crash makes it a clear operational risk for systems that rely on Excelize for spreadsheet handling.