The Excelize library’s checkSheet() function parses <row r="N"> attributes from an XLSX file and uses them directly as the length parameter for a slice allocation without validating the value against Excel’s maximum row limit of 1,048,576. Because no upper bound is enforced, an attacker can supply a value such as 2,147,483,647, causing the library to attempt a ~16 GB allocation and trigger an out‑of‑memory kill, or a value of –1, which results in a runtime panic from out‑of‑bounds indexing. Any service that opens attacker‑supplied XLSX files and calls GetCellValue is affected, and no authentication is required. This flaw is a classic instance of CWE‑770.

Any Go application that embeds the qax-os:excelize library and processes user‑supplied XLSX files through functions such as GetCellValue is vulnerable if it is using a version earlier than 2.11.0. This includes services, reporting tools, and any software that parses spreadsheets without performing its own validation.

The CVSS score of 7.5 marks the vulnerability as high severity. However, the EPSS score of less than 1 % and the absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation. The likely attack vector is a simple supply‑chain scenario where a crafted spreadsheet is delivered to any exposed endpoint that uses the library, with no credentials required, potentially exhausting memory or causing a crash and disrupting availability.