PT-2026-63654 · Unknown · Phpspreadsheet
CVE-2026-59932
·
Published
2026-07-12
·
Updated
2026-07-23
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
PhpSpreadsheet (affected versions not specified)
Description
An issue exists in the Gnumeric reader where the
gzfileGetContents() function in src/PhpSpreadsheet/Reader/Gnumeric.php incorrectly handles highly compressed input data. When a .gnumeric file starts with gzip magic bytes, the application calls gzdecode() on the full compressed contents without enforcing a limit on the decompressed size. This allows a remote attacker to provide a small compressed file that expands to a size exceeding the PHP memory limit, causing the process to crash during the execution of the canRead() function. This can lead to a denial of service in applications that accept spreadsheet uploads, such as document converters or preview services.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary workaround, restrict the use of the
gzfileGetContents() function or avoid processing untrusted .gnumeric files until a patch is available.Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Phpspreadsheet