PT-2026-37105 · Unknown · Phpspreadsheet

Published 2026-04-29 · Updated 2026-05-12 · CVE-2026-40863

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 1.30.4 PhpSpreadsheet versions prior to 2.1.16 PhpSpreadsheet versions prior to 2.4.5 PhpSpreadsheet versions prior to 3.10.5 PhpSpreadsheet versions prior to 5.7.0

Description The SpreadsheetML XML reader (ReaderXml) fails to validate the ss:Index row attribute against the maximum allowed row count. An attacker can provide a crafted SpreadsheetML XML file with an excessively high ss:Index value on a <Row> element, which inflates the internal cachedHighestRow variable. Consequently, any subsequent call to the getRowIterator() function without a specified end row will attempt to iterate through an enormous number of rows, leading to CPU exhaustion and a denial of service. This issue occurs because the $rowID read from the ss:Index attribute is cast to an integer without an upper bound check before being processed by getRowDimension() and getCell().

Recommendations Update to version 1.30.4 or newer. Update to version 2.1.16 or newer. Update to version 2.4.5 or newer. Update to version 3.10.5 or newer. Update to version 5.7.0 or newer.

Exploit

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-40863

GHSA-84WQ-86V6-X5J6

Affected Products

Phpspreadsheet

References · 5

• 🔥 https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-84wq-86v6-x5j6 · Exploit
• https://osv.dev/vulnerability/GHSA-84wq-86v6-x5j6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40863 · Security Note
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://twitter.com/CVEnew/status/2054340928286994928 · Twitter Post