PhpSpreadsheet is vulnerable to uncontrolled resource consumption (CWE-400) due to its OLE reader following sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing maximum chain length. Specifically, a crafted .xls/OLE file can cause the small-block depot sector chain to loop back on itself, leading OLERead::read() to repeatedly append the same sector data until PHP process memory is exhausted. This vulnerability is reachable during normal XLS detection via Reader\Xls::canRead(), including automatic spreadsheet type detection. The vulnerability affects multiple version ranges: all releases up to and including 1.30.5, 2.0.0 through 2.1.17, 2.2.0 through 2.4.6, 3.3.0 through 3.10.6, and 4.0.0 through 5.8.0. It has been fixed in versions 1.30.6, 2.1.18, 2.4.7, 3.10.7, and 5.8.1.

An attacker can cause a denial of service (DoS) by uploading a crafted XLS/OLE spreadsheet file that triggers uncontrolled memory consumption in the PhpSpreadsheet library during file parsing. This results in exhaustion of PHP process memory, potentially crashing or severely degrading the availability of applications that accept and process attacker-controlled spreadsheet uploads.

A fix is available. Users should upgrade to PhpSpreadsheet versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, or 1.30.6 or later, where the vulnerability has been addressed. Until upgraded, applications should consider restricting or validating uploaded spreadsheet files to prevent processing of maliciously crafted XLS/OLE files.