A flaw in PhpSpreadsheet's SpreadsheetML XML reader allows processing files that contain an ss:Index attribute set far beyond the maximum row count. Because the library does not validate the attribute, the cachedHighestRow value inflates to about one billion. Subsequent calls to getRowIterator(), when no explicit upper bound is provided, iterate that inflated range, consuming extensive CPU time and memory, leading to a denial of service. The vulnerability is classified as a resource exhaustion flaw (CWE‑770).

Vendors affected are PHPOffice:PhpSpreadsheet. All versions prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0 are vulnerable. Any PHP application that includes PhpSpreadsheet v1.x, v2.x, v3.x, or v5.x and accepts untrusted spreadsheet files may be impacted. The known fix is implementing the respective version or newer.

The CVSS score is 7.5, indicating a high severity. EPSS is not available, so the current exploitation probability cannot be quantified, but the vulnerability is not listed in CISA KEV. An attacker who can supply a crafted SpreadsheetML XML file can trigger the denial of service by causing the library to iterate an exorbitant number of rows. The attack requires only the ability to feed the vulnerable application with a malicious file; no elevated privileges or special network exposure are needed—the vector is likely application-level if the file is uploaded or processed.