CVE-2026-59932

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59932
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59932.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59932
Aliases
Published
2026-07-28T17:59:17.404Z
Modified
2026-08-01T03:47:17.528848125Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Details

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.

Database specific 
{
    "cwe_ids": [
        "CWE-400",
        "CWE-409"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59932.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/phpoffice/phpspreadsheet

Affected ranges

Type
GIT
Repo
https://github.com/phpoffice/phpspreadsheet
Events
Introduced
2d4b9f3582102aafb6b1378fff8a20eeeacfb31c
Fixed
01964d92536edf1a3a874b9580a52824bebf6fbb
Introduced
87ddd21eb0b6b7ad20a11d314348ef307475f547
Fixed
8de8215d6ff984f8db77a4a49dc089a396209e1b
Introduced
b0993b7e4d9c860133365d115b176bc6e0f57022
Fixed
0bbef382b7d9c1dbda10c8113d564ff9159a7e79
Introduced
4a77798f835119754961a97714f135826a323caa
Fixed
68d4ebf154c0193d0e4e2df1b79dc4a2d945aa5f
Fixed
85f2556b0bf5269061bf45932ecda8a128d81750
Fixed
a416375ffc8bf5b661c1bb4e6c60d8f3fddbe5ce
Fixed
c53c3ef749101fabc7269d6602e20faba55c4782
Fixed
03e65f7c3399756d77f656118f75a61e0fca23c6
Fixed
450a28a2c050d8f983e663c0bc8918e0cdae5708
Fixed
d368eec97b371589068255c5b1e0edf0e4403bed
Database specific 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "5.8.0"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.10.6"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.4.6"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.1.17"
        }
    ]
}

Affected versions

2.*
2.0.0
2.1.0
2.1.1
2.1.10
2.1.11
2.1.12
2.1.13
2.1.14
2.1.15
2.1.16
2.1.17
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.2.2
2.3.0
2.3.10
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
3.*
3.10.0
3.10.1
3.10.2
3.10.3
3.10.4
3.10.5
3.10.6
3.3.0
3.4.0
3.5.0
3.6.0
3.7.0
3.8.0
3.9.0
3.9.1
3.9.2
3.9.3
4.*
4.0.0
4.1.0
4.2.0
4.3.0
4.3.1
4.4.0
4.5.0
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.4.0
5.5.0
5.6.0
5.7.0
5.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59932.json"