CVE-2026-59933 PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Attackers can cause memory exhaustion and denial of service by uploading a small malformed XLS file to applications using PhpSpreadsheet.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59933?
CVE-2026-59933 is a high-severity denial of service vulnerability in PHPOffice PhpSpreadsheet, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.
Which versions are affected by CVE-2026-59933?
10 open source packages ship an affected version, including phpoffice/phpspreadsheet.
| Package | Affected | Fixed in |
|---|---|---|
phpoffice/phpspreadsheet Packagist | All versions | 1.30.6 |
phpoffice/phpspreadsheet Packagist | All versions | 1.30.6 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.18 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.18 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.7 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.7 |
4 more packages
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.7 |
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.7 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.8.1 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.8.1 |
How do I fix CVE-2026-59933?
Upgrade phpoffice/phpspreadsheet to a fixed version for your release line: 1.30.6, 2.1.18, 2.4.7 or 3.10.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59933 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59933 exists.
Sources
Also known as GHSA-xh5m-36r6-47m3.