PhpSpreadsheet does not validate the row number specified in an XLSX file’s <row> element. An attacker can create a minimal spreadsheet containing a row with a very large number, such as <row r="999999999"/>. The reader records this value as the highest row and then iterates over that many rows, resulting in roughly one billion loop iterations that consume CPU resources and can exhaust a processing server’s CPU. The attack does not provide code execution, but it can render the application or server unavailable until resources are freed.

The vulnerability affects the PhpSpreadsheet library distributed by PHPOffice. Versions earlier than 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0 are impacted. Upgrading to any of those fixed releases or later mitigates the issue.

The CVSS score is 7.5, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an attacker sending a crafted XLSX file to an application that reads spreadsheets, prompting the application to perform the CPU‑intensive row iteration. The exploit requires only the ability to supply an XLSX file, which is often a normal user operation, making the vulnerability exploitable under typical usage scenarios.