AIKIDO-2026-255817

phpoffice/phpspreadsheet is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)CVE-2026-59933 Published 4 days ago

High Risk

This Affects:

phpoffice/phpspreadsheet

0.0.1 - 1.30.5

Fixed in 1.30.6

2.0.0 - 2.1.17

Fixed in 2.1.18

2.2.0 - 2.4.6

Fixed in 2.4.7

3.3.0 - 3.10.6

Fixed in 3.10.7

4.0.0 - 5.8.0

Fixed in 5.8.1

Are you affected? Scan for Free

TL;DR

The OLE reader used by the XLS reader follows sector chains from attacker-controlled OLE metadata without detecting cycles or bounding the chain length. A tiny malformed .xls/OLE file can point the small-block depot sector chain back to itself, causing the reader to append the same sector data repeatedly until memory is exhausted. This is reachable during automatic file-type detection in canRead(), so untrusted uploads can trigger denial of service. The fix tracks visited blocks and throws a reader exception when a loop is detected.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application parses untrusted spreadsheet files.

Background info

phpoffice/phpspreadsheet is vulnerable to Denial of Service (DoS) in versions 4.0.0 - 5.8.0, 3.3.0 - 3.10.6, 2.2.0 - 2.4.6, 2.0.0 - 2.1.17 and 0.0.1 - 1.30.5.