CVE-2026-59932 PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Attackers can cause denial of service by uploading small gzip-compressed Gnumeric files that expand to exhaust memory during parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59932?
CVE-2026-59932 is a high-severity denial of service vulnerability in PHPOffice PhpSpreadsheet, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.
Which versions are affected by CVE-2026-59932?
10 open source packages ship an affected version, including phpoffice/phpspreadsheet.
| Package | Affected | Fixed in |
|---|---|---|
phpoffice/phpspreadsheet Packagist | All versions | 1.30.6 |
phpoffice/phpspreadsheet Packagist | All versions | 1.30.6 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.18 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.18 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.7 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.7 |
4 more packages
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.7 |
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.7 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.8.1 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.8.1 |
How do I fix CVE-2026-59932?
Upgrade phpoffice/phpspreadsheet to a fixed version for your release line: 1.30.6, 2.1.18, 2.4.7 or 3.10.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59932 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59932 exists.
Sources
Also known as GHSA-2mrg-gjxq-2gvr.