Excelize, a popular Go library for handling Microsoft Excel files, contains a flaw that causes an unrecovered panic when reading a worksheet that contains a row where an earlier cell references a higher column than the row’s final cell. The bug occurs because the library computes the size of the target cell slice based on the last cell’s column and then re‑scatters each cell according to its explicit column reference. When a malicious or malformed file places a cell with a larger column reference before the row’s final cell, the computed slice is too short, and accessing that earlier cell triggers an index‑out‑of‑range panic. This panic terminates the Go process executing the read, producing a denial‑of‑service condition but not enabling code execution or data disclosure.

Versions 2.0.0 through 2.11.0 of the qax‑os:excelize library are affected. The vulnerability manifests in any non‑streaming worksheet read API that calls checkRow, including GetCellValue and related functions. Applications built with Go that import this library— as custom reporting services, data import tools, or web backends that process user‑supplied Excel files—would be impacted if those applications load a crafted spreadsheet.

The CVSS score of 6.5 indicates medium severity. No EPSS score is currently published, and the vulnerability is not listed in CISA’s KEV catalog. Because the exploit requires the attacker to supply a specially crafted Excel file and the application to invoke a non‑streaming read routine, the attack vector is local to the application that processes spreadsheet data. An attacker who can upload or otherwise influence the contents of a spreadsheet can reliably trigger a crash, leading to service interruption. Until a fixed library release is available, no direct code‑execution vectors are known; the primary risk remains denial of service.