The vulnerability allows an attacker to craft a malicious ODS file containing an unbounded table:number-rows-repeated attribute. When processed by PhpSpreadsheet’s Ods::processTableRow method, the library materializes a cell instance for every repetition without enforcing a spreadsheet row limit, leading to excessive CPU consumption and memory allocation. The result is a denial‑of‑service that can terminate PHP workers and deplete server resources.

This flaw affects the PHPOffice PhpSpreadsheet library in all releases older than 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The issue was patched in these exact release versions. Any application that relies on an earlier version for reading ODS files is vulnerable.

With a CVSS score of 8.7 the vulnerability is considered high severity. No EPSS score is currently available and the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to arise from providing a malicious ODS document that the application reads; the unchecked repetition attribute can be triggered without authentication if an upload or import endpoint accepts arbitrary files. This can exhaust CPU and memory on the hosting environment, potentially causing service interruption. Because the library itself performs no checks, the exploitation likelihood depends largely on how the library is invoked but is considered significant in environments that accept user‑generated ODS files.