Log in / Sign up

Vulnerability details

CVE-2026-40902

PHPOffice PhpSpreadsheet

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

CVSS 3.1
7.5High

Official description

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

CVSS scores

ScoreVersionSourceVector
7.5High 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersionsSource
PHPOffice PhpSpreadsheet < 1.30.4 CVEProject cvelistV5 (CNA)
PHPOffice PhpSpreadsheet >= 2.0.0, < 2.1.16 CVEProject cvelistV5 (CNA)
PHPOffice PhpSpreadsheet >= 2.2.0, < 2.4.5 CVEProject cvelistV5 (CNA)
PHPOffice PhpSpreadsheet >= 3.3.0, < 3.10.5 CVEProject cvelistV5 (CNA)
PHPOffice PhpSpreadsheet >= 4.0.0, < 5.7.0 CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-05-13
Last updated
2026-05-13
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.39%
Probability of exploitation in 30 days
33.8%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
Proof of concept
Technical impact
Partial

Weaknesses (CWE)

  • CWE-770
    Allocation of Resources Without Limits or Throttling