Excelize is a Go library for handling Microsoft Excel spreadsheets. The flaw lies in the GetStyle function, which checks only the upper bounds of style‑table indices supplied from styles.xml. When a malicious file contains negative fillId, borderId or fontId values, the library accepts them and uses them as negative slice indices, which triggers a panic and crashes the application. This is a classic bounds‑checking error (CWE‑129) that results in denial of service because the process terminates.

The vulnerability affects the qax‑os Excelize library, specifically all releases from version 2.8.0 up to and including 2.11.0. Any program written in Go that imports this library and processes user‑supplied .xlsx files could be impacted.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted styles.xml file to an application that uses the affected library, which could be local or remote if the application accepts file uploads from external users. Because the issue results in a panic rather than code execution, the primary risk is denial of service, but it can also impact availability of services that rely on Excelize.