AIKIDO-2026-411546

phpoffice/phpspreadsheet is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)CVE-2026-59932 Published 4 days ago

High Risk

This Affects:

phpoffice/phpspreadsheet

0.0.1 - 1.30.5

Fixed in 1.30.6

2.0.0 - 2.1.17

Fixed in 2.1.18

2.2.0 - 2.4.6

Fixed in 2.4.7

3.3.0 - 3.10.6

Fixed in 3.10.7

4.0.0 - 5.8.0

Fixed in 5.8.1

Are you affected? Scan for Free

TL;DR

The Gnumeric reader reads an attacker-supplied .gnumeric file and calls gzdecode() on gzip-compressed contents without enforcing a decompressed-size limit. A very small compressed file can expand to data larger than the PHP memory limit, crashing the process during canRead() before the file is validated or fully parsed. Applications that accept untrusted spreadsheet uploads can be forced into denial of service by a tiny decompression bomb. The fix bounds decompression output using a maximum length derived from the configured memory limit.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application parses untrusted spreadsheet files.

Background info

phpoffice/phpspreadsheet is vulnerable to Denial of Service (DoS) in versions 4.0.0 - 5.8.0, 3.3.0 - 3.10.6, 2.2.0 - 2.4.6, 2.0.0 - 2.1.17 and 0.0.1 - 1.30.5.