Excelize, a Go library for handling Excel spreadsheets, has a flaw where an empty mergeCell reference in a worksheet causes the mergeCellsParser to produce an empty rectangle. This empty slice is then supplied to cellInRange, which attempts to read four indices from it. Because the slice has no length, the operation panics. The panic terminates the program that is using Excelize, effectively resulting in a denial‑of‑service condition for any operation that reads or writes such a worksheet. This issue is identified as an out‑of‑bounds read (CWE‑125) and a signed‑to‑unsigned conversion error (CWE‑129).

The vulnerability affects the Excelize Go library versions 2.7.1 through 2.11.0 inclusive. Users of any release in that range that load a worksheet containing an empty mergeCell reference are at risk.

The CVSS score of 6.5 rates it as a medium‑severity flaw, and the EPSS score is currently unavailable, indicating no explicit exploitation data. It is not listed in the CISA KEV catalog, so no public exploit is known. The attack vector is likely the supply of a crafted Excel file containing an empty mergeCell reference to any application that uses the non‑streaming cell API of Excelize. The exploit requires no special privileges beyond providing the file, so it can be performed by anyone who can influence the file input to a vulnerable application.