EUVD-2026-94534
GHSA-wp2g-vpjj-g53r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft XLSX with mutual ANCHORARRAY formulas
-
ExploitSubmit file to formula-evaluating service
-
ExecutionTrigger infinite recursive CalcCellValue cycle
-
ImpactExhaust Go stack and crash process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitation requires the host application to evaluate spreadsheet formulas from attacker-controlled input using Excelize's CalcCellValue or other formula-evaluating APIs, AND the input must contain mutually referencing dynamic-array formulas using the ANCHORARRAY function (e.g., cell A1 referencing B1 and B1 referencing A1 via _xlfn.ANCHORARRAY). Affected versions are 2.8.1 through 2.11.0. Limiting factors: applications that only read raw cell values without invoking formula calculation are not exposed; the vulnerability yields only a process crash (no code execution or data disclosure); and the crash requires the specific ANCHORARRAY recursion pattern rather than any arbitrary formula. No special authentication or user interaction is required at the library level, but reachability depends entirely on whether the application exposes the formula-evaluation code path to untrusted files. |
| Impact | This is a denial-of-service vulnerability (CWE-674, uncontrolled recursion) with a confirmed availability-only impact. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) indicates a network-reachable, low-complexity, unauthenticated condition causing high availability loss with no confidentiality or integrity impact - consistent with a fatal Go stack overflow that aborts the process. No EPSS score, KEV listing, or POC was provided in the input; per precision rules this is classified as 'no public exploit identified at time of analysis.' The real-world risk is moderate and contingent on deployment context: the 'network' vector only applies if an application exposes Excelize's formula-evaluation path (CalcCellValue or other formula-evaluating APIs) to attacker-supplied spreadsheets; applications that merely read cell values without evaluating formulas are not exposed. A key data conflict must be flagged: the description states 'No fixed version is available as of this review,' yet the input includes an upstream fix commit (ea12859e) replacing the recursive CalcCellValue call with cellResolver - so a patch exists in source even if no tagged release was cut at review time; verify the fixed release with the vendor advisory GHSA-wp2g-vpjj-g53r. Overall this is a legitimate but non-critical DoS, not a high-CVSS-but-illusory issue; it warrants patching for services processing untrusted spreadsheets but carries no code-execution or data-exposure risk. |
| Exploit ScenarioDerived | An attacker uploads a crafted XLSX file containing two dynamic-array formulas that mutually reference each other via ANCHORARRAY (e.g., A1=ANCHORARRAY($B$1), B1=ANCHORARRAY($A$1)) to a service that evaluates spreadsheet formulas using Excelize's CalcCellValue API. Because each ANCHORARRAY hop calls CalcCellValue and spawns a fresh calculation context, the cycle-detection budget resets every recursion and never terminates, exhausting the Go goroutine stack and crashing the process. No public exploit code was provided, but the upstream fix commit includes a reproducing test case (TestCalcANCHORARRAY/with_circular_references) that demonstrates the trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Uncontrolled recursion in the Excelize Go library (versions 2.8.1 through 2.11.0) allows a fatal Go stack overflow that aborts the host process when mutually referencing dynamic-array formulas using _xlfn.ANCHORARRAY are evaluated, resulting in a pure availability impact (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Reachability depends entirely on the host application: it is exploitable only when an application feeds attacker-controlled spreadsheet content into CalcCellValue or another formula-evaluating API, while applications that merely read raw cell values are unaffected. No public exploit code has been identified at time of analysis, and although an upstream fix commit exists, no released patched version has been confirmed (the advisory states no fixed version is available as of its review).
RemediationAI
No vendor-released patched version is confirmed - the GHSA advisory (https://github.com/qax-os/excelize/security/advisories/GHSA-wp2g-vpjj-g53r) states no fixed version is available as of its review, so the primary actionable fix is to apply the upstream commit ea12859e43c64d498ecf839263c5f917391f3316 (https://github.com/qax-os/excelize/commit/ea12859e43c64d498ecf839263c5f917391f3316), which routes ANCHORARRAY through cellResolver(fn.ctx, ...) so the shared calcContext, cycle state, and iteration budget are preserved, or to vendor-patch calc.go equivalently and rebuild; track the repository for an eventual tagged release and upgrade to it once published. Until a patched build is deployed, compensating controls should target the exposed formula-evaluation path: avoid calling CalcCellValue and other formula-evaluating APIs on untrusted or externally supplied workbooks (trade-off: legitimate formula results will not be computed, and only RawCellValue reads will be available), or pre-screen uploaded XLSX files and reject or quarantine any workbook containing _xlfn.ANCHORARRAY formulas that participate in circular references such as A1→B1 and B1→A1 (trade-off: screening must be kept in sync with Excel formula syntax to avoid bypasses and false rejections of benign dynamic-array files); otherwise isolate the calculation step in a short-lived worker process with a strict memory/stack ceiling and restart-on-crash supervision (trade-off: attacker-supplied crash still terminates the worker and can be used for repeated resource churn, so it reduces rather than eliminates the availability impact). Note that wrapping the call in a Go recover() does not mitigate this issue, since a fatal stack overflow is not recoverable at the library level.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Excelize is a pure-Go library for reading and writing Microsoft Excel (XLSX) spreadsheets, and the flaw sits in its formula calculation engine (calc.go). ANCHORARRAY is the dynamic-array spill operator (_xlfn.ANCHORARRAY) that returns the array anchored at a referenced cell; to resolve that reference the implementation historically called the exported, top-level CalcCellValue function. That call constructs a brand-new calcContext and evaluator state, so each recursive hop through a circular reference discards the in-flight evaluation state, cycle-detection bookkeeping, and iteration budget instead of resolving through the internal cellResolver using the existing context. The result is an unbounded recursion chain (CWE-674, uncontrolled recursion) that exhausts the goroutine stack and triggers a fatal Go runtime stack-overflow abort that cannot be recovered by the caller - the tags label this a buffer overflow, but the root cause is stack exhaustion rather than memory corruption. The upstream commit ea12859e43c64d498ecf839263c5f917391f3316 replaces the CalcCellValue call in ANCHORARRAY with cellResolver(fn.ctx, ...) and normalizes empty results to an empty string, which preserves the shared context and lets cycle handling and completion-based caches terminate the evaluation. The affected component is tracked as cpe:2.3:a:qax-os:excelize with an unbounded version range, matching the 2.8.1-2.11.0 range described in the advisory.
Know when Excelize gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Untrusted spreadsheet processed over a network service with low-complexity trigger and no auth, causing process crash; availability-only impact, no confidentiality or integrity loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypassing in-flight and iteration controls. ANCHORARRAY calls CalcCellValue instead of cellResolver, so each recursive hop receives a new calcContext and loses cycle state. When mutually referencing dynamic-array formulas are evaluated directly or through formula-evaluating APIs, each recursion hop resets the cycle budget and prevents completion-based caches from breaking the cycle, allowing an attacker to cause a fatal Go stack overflow and abort the process. No fixed version is available as of this review.
Technical POC Analysis
CWE-674 (Uncontrolled Recursion).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity defect in the Excelize Go library affects applications that parse and evaluate spreadsheet formulas, letting attacker-supplied workbook content abort the hosting process. Only services that actively evaluate formulas on untrusted files are exposed; systems that merely read stored cell values are unaffected. Because no released fix is available and the flaw is remotely reachable without credentials, any internet-facing service that opens customer-supplied spreadsheets should be treated as an availability risk until the affected code path is contained or isolated.
No vendor-released patch identified at time of analysis. Interim mitigations: avoid calling CalcCellValue or other formula-evaluation APIs on untrusted or attacker-supplied workbooks (parse raw cell values only where business logic permits); strip or block dynamic-array formulas referencing _xlfn.ANCHORARRAY before processing; isolate formula evaluation in sandboxed, resource-capped workers or separate processes that can restart automatically after an abort; enforce upload size limits and throttling; and monitor for unexpected process terminations to detect repeated crash attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Denial of service in the Excelize Go library (github.com/xuri/excelize/v2, a.k.a. qax-os/excelize) before 2.11.0 allows
Denial of service in the Excelize Go library (versions 2.1.0 through 2.11.0) allows an attacker-controlled spreadsheet t
A crafted Excel (.xlsx) file can crash any Go application that parses it with Excelize 2.0.0 through 2.11.0 using a non-
Uncontrolled memory and CPU consumption in Excelize (qax-os/excelize), the widely used Go library for reading and writin
Denial of service in Excelize 2.9.0 through 2.11.0 allows a crafted spreadsheet to panic and terminate a Go process that
Go slice-bounds panic in the Excelize spreadsheet library versions 2.8.1 through 2.11.0 lets a crafted .xlsx workbook cr
Denial of service in the Excelize Go library (versions 2.3.1 through 2.11.0) allows unauthenticated remote attackers to
Denial of service in the Excelize Go spreadsheet library (github.com/xuri/excelize/v2 2.0.0-2.11.0 and github.com/xuri/e
Denial of service in Excelize versions 2.3.1 through 2.11.0 allows unauthenticated remote attackers to terminate the cal
Memory exhaustion and runtime panic in the Excelize Go library (versions 2.3.1 through 2.11.0) let unauthenticated remot
Resource exhaustion in the Excelize Go library (versions 2.1.0 through 2.11.0) lets a crafted .xlsx workbook drive exces
Panic-triggering denial of service in the Excelize Go library (all versions prior to 2.11.0) allows any actor who can su
Exploit-DB