Is CVE-2026-107216 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107216 being exploited in the wild.

How severe is CVE-2026-107216?

High severity, with a CVSS score of 7.5, published 8 October 2026.

Which products and versions are affected?

Excelize up to ecd99d761fe0 (2026-09-08); github.com/xuri/excelize/v2 (Go) >= 2.8.1, < 2.11.1-0.20260911060113-ea12859e43c6, SEMVER:introduced=2.8.1,fixed=2.11.1-0.20260911060113-ea12859e43c6.

Is there a fix for CVE-2026-107216?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260911060113-ea12859e43c6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107216 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107216?

Check whether you run Excelize or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107216: Excelize ANCHORARRAY mutually-referencing formulas stack overflow

Q: Is there a fix for CVE-2026-107216?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260911060113-ea12859e43c6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107216 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107216?

Check whether you run Excelize or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107216 · Severity: high · CVSS 7.5 · Published 2026-10-08

Excelize is a Go library for reading and writing Excel spreadsheets. An attacker can craft a workbook with two mutually-referencing array formulas that cause the library to recurse unboundedly and crash with a fatal stack overflow when the spreadsheet is processed—such as when adding a pivot table, picture, or calculating a formula. This is a remote, unauthenticated denial of service requiring no special configuration to exploit.

Technologies: Excelize, github.com/xuri/excelize/v2 (Go). Vendors: Excelize, Go.

Quick answers

Is CVE-2026-107216 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107216 being exploited in the wild.
How severe is CVE-2026-107216?: High severity, with a CVSS score of 7.5, published 8 October 2026.
Which products and versions are affected?: Excelize up to ecd99d761fe0 (2026-09-08); github.com/xuri/excelize/v2 (Go) >= 2.8.1, < 2.11.1-0.20260911060113-ea12859e43c6, SEMVER:introduced=2.8.1,fixed=2.11.1-0.20260911060113-ea12859e43c6.
Is there a fix for CVE-2026-107216?: Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260911060113-ea12859e43c6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107216 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107216?: Check whether you run Excelize or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260911060113-ea12859e43c6 or later
```
go get github.com/xuri/excelize/v2@v2.11.1-0.20260911060113-ea12859e43c6
```

Technical details

The ANCHORARRAY function in Excelize's calc.go unconditionally calls the exported CalcCellValue function for each cell in a referenced spill range, creating a fresh calculation context with full iteration budget on each call. Circular-reference detection and iteration limits are scoped only within a single context, not across re-entrant calls; two Excel-legal mutually-referencing array formulas (A1 references B1, B1 references A1) cause infinite recursion across context boundaries. The stack overflow is fatal and unrecoverable in Go, terminating the entire process.

Affected products

Excelize Excelize up to ecd99d761fe0 (2026-09-08)

Identifiers

CVE-2026-107216
GHSA-wp2g-vpjj-g53r
GO-2026-6688

Timeline

2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.