PT-2026-37107 · Unknown · Phpspreadsheet

Offset · Published 2026-04-29 · Updated 2026-05-12 · CVE-2026-40902

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 1.30.4 PhpSpreadsheet versions prior to 2.1.16 PhpSpreadsheet versions prior to 2.4.5 PhpSpreadsheet versions prior to 3.10.5 PhpSpreadsheet versions prior to 5.7.0

Description The XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX ROW). An attacker can craft a minimal XLSX file containing a <row r="999999999"/> element that inflates the cachedHighestRow variable. This causes any subsequent row iteration to attempt approximately 1 billion loop cycles, leading to CPU resource exhaustion and potential memory exhaustion if data is accumulated during iteration. This issue occurs because the row index is cast directly from XML without bounds checking in the readRowAttributes() function.

Recommendations Update to version 1.30.4. Update to version 2.1.16. Update to version 2.4.5. Update to version 3.10.5. Update to version 5.7.0.

Exploit

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-40902

GHSA-7C6M-4442-2X6M

Affected Products

Phpspreadsheet

References · 5

• 🔥 https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7c6m-4442-2x6m · Exploit
• https://osv.dev/vulnerability/GHSA-7c6m-4442-2x6m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40902 · Security Note
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://twitter.com/CVEnew/status/2054340929251610811 · Twitter Post