The Excelize library’s checkSheet() function parses <row r=\"N\"> attributes from an XLSX file and uses them directly as the length parameter for a slice allocation without validating the value against Excel’s maximum row limit of 1,048,576. Because no upper bound is enforced, an attacker can supply a value such as 2,147,483,647, causing the library to attempt a ~16 GB allocation and trigger an out‑of‑memory kill, or a value of –1, which results in a runtime panic from out‑of‑bounds indexing. The flaw is a classic instance of CWE‑770 and requires no authentication to exploit, allowing an adversary simply to deliver a crafted spreadsheet file. The issue was fixed in version 2.11.0.

Any Go application that embeds the qax-os:excelize library and processes user‑supplied XLSX files through functions such as GetCellValue is vulnerable if it is using a version earlier than 2.11.0. This includes services, reporting tools, and any software that parses spreadsheets without performing its own validation.

The CVSS score of 7.5 marks the vulnerability as high severity. However, the EPSS score of less than 1 % and the absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation. The attack vector is a simple supply‑chain can be sent to any exposed endpoint that uses the library, with no credentials required, potentially exhausting memory or causing a crash and disrupting availability.