# CVE-2026-107216: Excelize ANCHORARRAY mutually-referencing formulas stack overflow

Source: https://junglewise.ai/threats/cve-2026-107216-excelize-anchorarray-mutually-referencing-array-formulas-recurse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107216 · Severity: high · CVSS 7.5 · Published 2026-10-08

Excelize is a Go library for reading and writing Excel spreadsheets. An attacker can craft a workbook with two mutually-referencing array formulas that cause the library to recurse unboundedly and crash with a fatal stack overflow when the spreadsheet is processed—such as when adding a pivot table, picture, or calculating a formula. This is a remote, unauthenticated denial of service requiring no special configuration to exploit.

Technologies: [Excelize](https://junglewise.ai/threats/technologies/excelize-excelize), [github.com/xuri/excelize/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-xuri-excelize-v2). Vendors: [Excelize](https://junglewise.ai/threats/vendors/excelize), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-107216 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107216 being exploited in the wild.

**How severe is CVE-2026-107216?** High severity, with a CVSS score of 7.5, published 8 October 2026.

**Which products and versions are affected?** Excelize up to ecd99d761fe0 (2026-09-08); github.com/xuri/excelize/v2 (Go) >= 2.8.1, < 2.11.1-0.20260911060113-ea12859e43c6, SEMVER:introduced=2.8.1,fixed=2.11.1-0.20260911060113-ea12859e43c6.

**Is there a fix for CVE-2026-107216?** Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260911060113-ea12859e43c6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107216 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107216?** Check whether you run Excelize or github.com/xuri/excelize/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260911060113-ea12859e43c6 or later

  ```sh
  go get github.com/xuri/excelize/v2@v2.11.1-0.20260911060113-ea12859e43c6
  ```


## Technical details

The ANCHORARRAY function in Excelize's calc.go unconditionally calls the exported CalcCellValue function for each cell in a referenced spill range, creating a fresh calculation context with full iteration budget on each call. Circular-reference detection and iteration limits are scoped only within a single context, not across re-entrant calls; two Excel-legal mutually-referencing array formulas (A1 references B1, B1 references A1) cause infinite recursion across context boundaries. The stack overflow is fatal and unrecoverable in Go, terminating the entire process.

## Affected products

- Excelize Excelize up to ecd99d761fe0 (2026-09-08)

## Identifiers

- CVE-2026-107216
- GHSA-wp2g-vpjj-g53r
- GO-2026-6688

## Timeline

- 2026-10-08: disclosed

## Related threats

- [Excelize unchecked pivot-cache field index bounds in extractPivotTableFields](https://junglewise.ai/threats/cve-2026-107211-excelize-unchecked-pivot-cache-field-index-in)
- [Excelize unbounded row iteration denial of service](https://junglewise.ai/threats/cve-2026-107212-excelize-unbounded-row-number-in-rows-columns-makes-getrows-and)
- [Excelize nil-pointer dereference in GetSlicers](https://junglewise.ai/threats/cve-2026-107213-excelize-nil-pointer-dereference-in-getslicers-when-a-worksheet)
- [Excelize Decrypt panic on malformed OLE encrypted workbooks](https://junglewise.ai/threats/cve-2026-107214-excelize-decrypt-unrecoverable-panics-on-malformed-ole-cfb)
- [Excelize extractPart unbounded buffer allocation DoS](https://junglewise.ai/threats/cve-2026-107215-excelize-extractpart-allocates-attacker-controlled-unbounded-and)