CVE-2026-40902

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

Published May 12, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

Analysis

Technical impact

PhpSpreadsheet does not validate the row number specified in an XLSX file’s <row> element. An attacker can create a minimal spreadsheet containing a row with a very large number, such as <row r="999999999"/>. The reader records this value as the highest row and then iterates over that many rows, resulting in roughly one billion loop iterations that consume CPU resources and can exhaust a processing server’s CPU. The attack does not provide code execution, but it can render the application or server unavailable until resources are freed.

Affected Systems

The vulnerability affects the PhpSpreadsheet library distributed by PHPOffice. Versions earlier than 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0 are impacted. Upgrading to any of those fixed releases or later mitigates the issue.

Risk and Exploitability

The CVSS score is 7.5, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an attacker sending a crafted XLSX file to an application that reads spreadsheets, prompting the application to perform the CPU‑intensive row iteration. The exploit requires only the ability to supply an XLSX file, which is often a normal user operation, making the vulnerability exploitable under typical usage scenarios.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

PHPOffice

PhpSpreadsheet

affected

Version	Status	Constraints
`< 1.30.4`	affected	—
`>= 2.0.0, < 2.1.16`	affected	—
`>= 2.2.0, < 2.4.5`	affected	—
`>= 3.3.0, < 3.10.5`	affected	—
`>= 4.0.0, < 5.7.0`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:phpoffice:phpspreadsheet::::::::
	cpe:2.3:a:phpoffice:phpspreadsheet::::::::
	cpe:2.3:a:phpoffice:phpspreadsheet::::::::
	cpe:2.3:a:phpoffice:phpspreadsheet::::::::
	cpe:2.3:a:phpoffice:phpspreadsheet::::::::

No data.

Vendor Product Versions

Phpoffice

Phpspreadsheet

Version	Status	Scheme	Platform
`[0,1.30.4)`	affected	semver	—
`[2.0.0,2.1.16)`	affected	semver	—
`[2.2.0,2.4.5)`	affected	semver	—
`[3.3.0,3.10.5)`	affected	semver	—
`[4.0.0,5.7.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade PhpSpreadsheet to version 1.30.4 or later (or to 2.1.16, 2.4.5, 3.10.5, or 5.7.0).
Before processing an XLSX file, check that any <row r="…"> attribute does not exceed the maximum allowed row count (1,048,576) and reject or truncate files that violate this constraint.
Configure PHP or the host environment to limit script execution time and CPU usage for spreadsheet processing, or run the processing in a sandboxed context to contain any denial‑of‑service impact.

Generated by OpenCVE AI on May 12, 2026 at 23:39 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-7c6m-4442-2x6m	PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.395% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7c6m-4442-2x6m

History

May 14, 2026 3:00 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:phpoffice:phpspreadsheet::::::::

May 13, 2026 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 13, 2026 12:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Phpoffice Phpoffice phpspreadsheet
Vendors & Products		Phpoffice Phpoffice phpspreadsheet

May 12, 2026 10:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
Title		PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
Weaknesses		CWE-770
References		https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7c6m-4442-2x6m
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`