CVE-2026-59932: CWE-400: Uncontrolled Resource Consumption in PHPOffice PhpSpreadsheet
PhpSpreadsheet versions up to 5.8.0 (and several earlier branches) contain a vulnerability in the Gnumeric file reader where attacker-supplied .gnumeric files starting with gzip magic bytes can cause excessive memory consumption. This happens because the library calls gzdecode() on the full compressed contents without limiting the decompressed size, potentially leading to a denial of service by crashing the PHP process. The issue is fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.
AI Analysis
Technical Summary
PhpSpreadsheet is vulnerable to uncontrolled resource consumption (CWE-400) in its Gnumeric reader component. When processing .gnumeric files that begin with gzip magic bytes, the library decompresses the entire file using gzdecode() without enforcing a limit on the decompressed size. This can cause a small compressed file to expand beyond PHP's memory limits, crashing the process during the Gnumeric::canRead() method before the file is fully parsed or rejected. This vulnerability can be triggered via normal file-type detection and loading paths, affecting applications that accept attacker-controlled spreadsheet uploads. The vulnerability affects multiple version ranges: all releases up to and including 1.30.5, 2.0.0 through 2.1.17, 2.2.0 through 2.4.6, 3.3.0 through 3.10.6, and 4.0.0 through 5.8.0. Fixed versions are 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.
Potential Impact
An attacker can cause a denial of service by uploading a crafted .gnumeric file that decompresses to a size exceeding PHP's memory limit, causing the application process to crash. There is no impact on confidentiality or integrity reported. The impact is limited to availability disruption.
Mitigation Recommendations
A fix is available in PhpSpreadsheet versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6. Users should upgrade to these or later versions to remediate the vulnerability. Until upgraded, applications should consider restricting or validating .gnumeric file uploads to prevent processing of malicious compressed files.
CVE-2026-59932: CWE-400: Uncontrolled Resource Consumption in PHPOffice PhpSpreadsheet
Description
PhpSpreadsheet versions up to 5.8.0 (and several earlier branches) contain a vulnerability in the Gnumeric file reader where attacker-supplied .gnumeric files starting with gzip magic bytes can cause excessive memory consumption. This happens because the library calls gzdecode() on the full compressed contents without limiting the decompressed size, potentially leading to a denial of service by crashing the PHP process. The issue is fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.
CVSS v3.1
Score 7.5high
Affected software
PHPOffice
PhpSpreadsheet
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PhpSpreadsheet is vulnerable to uncontrolled resource consumption (CWE-400) in its Gnumeric reader component. When processing .gnumeric files that begin with gzip magic bytes, the library decompresses the entire file using gzdecode() without enforcing a limit on the decompressed size. This can cause a small compressed file to expand beyond PHP's memory limits, crashing the process during the Gnumeric::canRead() method before the file is fully parsed or rejected. This vulnerability can be triggered via normal file-type detection and loading paths, affecting applications that accept attacker-controlled spreadsheet uploads. The vulnerability affects multiple version ranges: all releases up to and including 1.30.5, 2.0.0 through 2.1.17, 2.2.0 through 2.4.6, 3.3.0 through 3.10.6, and 4.0.0 through 5.8.0. Fixed versions are 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.
Potential Impact
An attacker can cause a denial of service by uploading a crafted .gnumeric file that decompresses to a size exceeding PHP's memory limit, causing the application process to crash. There is no impact on confidentiality or integrity reported. The impact is limited to availability disruption.
Mitigation Recommendations
A fix is available in PhpSpreadsheet versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6. Users should upgrade to these or later versions to remediate the vulnerability. Until upgraded, applications should consider restricting or validating .gnumeric file uploads to prevent processing of malicious compressed files.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-07T18:20:06.126Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a68f3759c2644c7f803d884
Added to database: 07/28/2026, 18:22:45 UTC
Last enriched: 08/05/2026, 15:03:55 UTC
Last updated: 09/10/2026, 20:01:09 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.