Excelize is a Go library that processes Microsoft Excel files. Prior to version 2.11.0 it converts the shared‑string identifier to an integer and verifies only the upper bound before accessing the shared‑string slice. If an attacker supplies an XLSX file containing a shared‑string cell with the value -1, the library will attempt to read sharedStrings[-1] and the Go runtime will panic. This panic terminates the host application, resulting in a denial‑of‑service condition for any service that uses GetCellValue or GetRows to read the malicious workbook. The flaw is a classic Bounds‑Check Bypass weakness, reflected in CWE‑248 and CWE‑755.

Any Go application that imports qax-os Excelize before version 2.11.0 and processes XLSX files is vulnerable. Based on the description, it is inferred that this includes command‑line utilities, web services, or backend pipelines that call GetCellValue or GetRows on workbook data from untrusted sources.

With a CVSS score of 6.9 the vulnerability is considered medium severity. The EPSS score is less than 1%, indicating a very low likelihood of exploitation, and it is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires the delivery of a crafted file to the target application. Once the malicious workbook is processed by GetCellValue or GetRows, the library panics and the entire application crashes, providing a relatively clean denial‑of‑service attack.