PT-2026-63656 · Unknown · Phpspreadsheet

CVE-2026-59933 · Published 2026-07-12 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet (affected versions not specified)

Description The OLE reader in PhpSpreadsheet follows sector chains from XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A malformed file can set the small-block depot sector chain to point back to itself, causing the OLERead::read() function to append the same sector data repeatedly. This leads to memory exhaustion and a denial of service. The issue is reachable via ReaderXls::canRead() and automatic spreadsheet type detection, meaning applications accepting spreadsheet uploads are at risk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Infinite Loop

Weakness Enumeration

CWE-400

CWE-835

Related Identifiers

BDU:2026-10360

CVE-2026-59933

GHSA-XH5M-36R6-47M3

Affected Products

Phpspreadsheet

References · 10

• https://bdu.fstec.ru/vul/2026-10360 · Security Note
• https://osv.dev/vulnerability/GHSA-xh5m-36r6-47m3 · Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1 · Note
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18 · Note
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3 · Note