CVE-2026-59933: PHPSpreadsheet Memory Exhaustion Due to XLS/OLE Sector-Chain Self-Loop
Summary
CVE-2026-59933: PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion. Affects phpoffice/phpspreadsheet across 5 version ranges.
< 1.30.6
>= 2.0.0, < 2.1.18
>= 2.2.0, < 2.4.7
>= 3.3.0, < 3.10.7
>= 4.0.0, < 5.8.1
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPSpreadsheet is a popular open-source library used for reading and writing spreadsheet files in various formats, including Excel. It provides a comprehensive set of features for manipulating spreadsheet data, making it a valuable tool for developers. However, it is vulnerable to a specific issue where malformed XLS/OLE files can cause memory exhaustion, leading to denial of service in applications that utilize this library.
Vulnerability Detail
The vulnerability arises from the OLE reader in PHPSpreadsheet, which follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. An attacker can create a tiny malformed .xls file that causes the small-block depot sector chain to point back to itself. This results in an infinite loop during the reading process, where the same sector data is appended repeatedly until the PHP process exhausts its memory. The issue is particularly dangerous as it can be triggered during automatic spreadsheet type detection, affecting applications that accept user-uploaded spreadsheets.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.30.61.30.6composer require phpoffice/phpspreadsheet:1.30.6 -
>= 2.0.0, < 2.1.182.1.18composer require phpoffice/phpspreadsheet:2.1.18 -
>= 2.2.0, < 2.4.72.4.7composer require phpoffice/phpspreadsheet:2.4.7 -
>= 3.3.0, < 3.10.73.10.7composer require phpoffice/phpspreadsheet:3.10.7 -
>= 4.0.0, < 5.8.15.8.1composer require phpoffice/phpspreadsheet:5.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation to reject any XLS/OLE files that do not conform to expected formats or sizes before processing them with PHPSpreadsheet. This can help mitigate the risk of memory exhaustion from malformed files.
Conclusion
CVE-2026-59933 poses a significant risk to applications using PHPSpreadsheet by allowing attackers to exploit malformed XLS/OLE files, leading to memory exhaustion. It is crucial to update to the latest patched versions of the library and implement input validation as a temporary measure to mitigate this risk.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
CVE-2026-59933 is a vulnerability in PHPSpreadsheet that allows for memory exhaustion due to a self-loop in the XLS/OLE sector chain.
If your application processes user-uploaded spreadsheets using PHPSpreadsheet, it may crash or become unresponsive due to memory exhaustion caused by this vulnerability.
Affected versions include all versions prior to 5.8.1, 3.10.7, 2.4.7, and 2.1.18.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your composer.lock file to Vulert, you can receive real-time alerts about vulnerabilities, including CVE-2026-59933.
Yes, implementing strict input validation for uploaded spreadsheet files can help prevent the exploitation of this vulnerability until you can update to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
