CVE-2026-40902
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| PHPOffice | PhpSpreadsheet | < 1.30.4 | affected |
| PHPOffice | PhpSpreadsheet | >= 2.0.0, < 2.1.16 | affected |
| PHPOffice | PhpSpreadsheet | >= 2.2.0, < 2.4.5 | affected |
| PHPOffice | PhpSpreadsheet | >= 3.3.0, < 3.10.5 | affected |
| PHPOffice | PhpSpreadsheet | >= 4.0.0, < 5.7.0 | affected |
Weaknesses
- CWE-770: CWE-770: Allocation of Resources Without Limits or Throttling
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: yes
- Technical Impact: partial
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.