Denial of Service Vulnerability in PhpSpreadsheet Gnumeric Reader
CVE-2026-59932
7.5HIGH
What is CVE-2026-59932?
A vulnerability in the Gnumeric reader of the PhpSpreadsheet library allows attacker-controlled .gnumeric files to exploit the gzdecode() function without a decompressed-size limit. This means that an attacker can craft a small .gnumeric file that expands in size, potentially exceeding PHP's memory limit, and result in a denial of service when the file is processed. This issue poses a risk to applications that accept file uploads, making it essential to upgrade to fixed versions (5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6) to mitigate the risk.
Affected Version(s)
PhpSpreadsheet >= 4.0.0, < 5.8.1 < 4.0.0, 5.8.1
PhpSpreadsheet >= 3.3.0, < 3.10.7 < 3.3.0, 3.10.7
PhpSpreadsheet >= 2.2.0, < 2.4.7 < 2.2.0, 2.4.7