CVE-2026-59932: PHPSpreadsheet Gnumeric Reader Unbounded Gzip Expansion Causes Memory Exhaustion
Summary
CVE-2026-59932: PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion. Affects phpoffice/phpspreadsheet across 5 version ranges.
< 1.30.6
>= 2.0.0, < 2.1.18
>= 2.2.0, < 2.4.7
>= 3.3.0, < 3.10.7
>= 4.0.0, < 5.8.1
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPSpreadsheet is a popular library for reading and writing spreadsheet files in PHP. It supports various formats, including Excel and Gnumeric. The library is widely used in web applications for data manipulation and reporting. However, it has a vulnerability in its Gnumeric reader that allows for unbounded gzip expansion, which can lead to memory exhaustion and denial of service.
Vulnerability Detail
The vulnerability arises from the Gnumeric reader's handling of gzip-compressed files. When a .gnumeric file begins with gzip magic bytes, the library calls gzdecode() on the entire compressed content without imposing a limit on the decompressed size. This can lead to a scenario where a small compressed file expands into a significantly larger size, exceeding PHP's memory limit and crashing the process. The vulnerability is triggered during the type detection phase, making it exploitable through normal file uploads in applications that utilize PHPSpreadsheet.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.30.61.30.6composer require phpoffice/phpspreadsheet:1.30.6 -
>= 2.0.0, < 2.1.182.1.18composer require phpoffice/phpspreadsheet:2.1.18 -
>= 2.2.0, < 2.4.72.4.7composer require phpoffice/phpspreadsheet:2.4.7 -
>= 3.3.0, < 3.10.73.10.7composer require phpoffice/phpspreadsheet:3.10.7 -
>= 4.0.0, < 5.8.15.8.1composer require phpoffice/phpspreadsheet:5.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted .gnumeric files until the library is updated. Additionally, implement file size checks before processing to prevent excessively large files from being uploaded.
Conclusion
The vulnerability CVE-2026-59932 in PHPSpreadsheet's Gnumeric reader poses a significant risk of memory exhaustion through unbounded gzip expansion. It is crucial to update to the latest patched versions of the library and implement temporary workarounds to mitigate the risk until the update can be applied.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Web applications that allow users to upload .gnumeric files are at risk, especially if they use PHPSpreadsheet for processing.
If exploited, your application may experience denial of service due to memory exhaustion, potentially crashing the PHP worker.
Yes, you can implement file size checks and avoid processing untrusted .gnumeric files until the vulnerability is patched.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
