CVE-2026-59933

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59933
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59933.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59933
Aliases
Published
2026-07-28T17:29:27.129Z
Modified
2026-07-29T03:47:32.608076867Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Details

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59933.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "5.8.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-400",
        "CWE-835"
    ]
}
References

Affected packages

Git / github.com/phpoffice/phpspreadsheet

Affected ranges

Type
GIT
Repo
https://github.com/phpoffice/phpspreadsheet
Events
Introduced
87ddd21eb0b6b7ad20a11d314348ef307475f547
Fixed
450a28a2c050d8f983e663c0bc8918e0cdae5708
Introduced
b0993b7e4d9c860133365d115b176bc6e0f57022
Fixed
03e65f7c3399756d77f656118f75a61e0fca23c6
Introduced
4a77798f835119754961a97714f135826a323caa
Fixed
c53c3ef749101fabc7269d6602e20faba55c4782
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a416375ffc8bf5b661c1bb4e6c60d8f3fddbe5ce
Database specific 
{
    "extracted_events": [
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.10.7"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.4.7"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.1.18"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "1.30.6"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.0
1.0.0-beta2
1.1.0
1.10.0
1.10.1
1.11.0
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.17.1
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.24.1
1.25.0
1.25.1
1.25.2
1.27.0
1.28.0
1.29.0
1.29.1
1.29.10
1.29.11
1.29.12
1.29.2
1.29.4
1.29.5
1.29.6
1.29.7
1.29.8
1.29.9
1.3.0
1.3.1
1.30.0
1.30.1
1.30.2
1.30.3
1.30.4
1.30.5
1.4.0
1.4.1
1.5.0
1.6.0
1.7.0
1.8.0
1.8.1
1.8.2
2.*
2.0.0
2.1.0
2.1.1
2.1.10
2.1.11
2.1.12
2.1.13
2.1.14
2.1.15
2.1.16
2.1.17
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.2.2
2.3.0
2.3.10
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
3.*
3.10.0
3.10.1
3.10.2
3.10.3
3.10.4
3.10.5
3.10.6
3.3.0
3.4.0
3.5.0
3.6.0
3.7.0
3.8.0
3.9.0
3.9.1
3.9.2
3.9.3
Other
phpexcel-last-cherry-picked-commit
phpexcel-last-release-1.*
phpexcel-last-release-1.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59933.json"