Denial of Service Vulnerability in PhpSpreadsheet by PHPOffice
CVE-2026-59933
7.5HIGH
What is CVE-2026-59933?
A vulnerability exists in the PhpSpreadsheet library that allows attackers to create a specially crafted XLS/OLE file. This file can exploit the OLE reader, leading to infinite sector chains that consume memory resources during normal spreadsheet detection. Applications that process user-uploaded spreadsheet files may experience a denial of service due to memory exhaustion caused by these malformed files. This issue has been addressed in later versions of PhpSpreadsheet, specifically 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.
Affected Version(s)
PhpSpreadsheet >= 4.0.0, < 5.8.1 < 4.0.0, 5.8.1
PhpSpreadsheet >= 3.3.0, < 3.10.7 < 3.3.0, 3.10.7
PhpSpreadsheet >= 2.2.0, < 2.4.7 < 2.2.0, 2.4.7