Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.
Published: 2026-07-28
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The PHP library PhpSpreadsheet contains a flaw in its Gnumeric file reader where gzdecode() is called on the entire compressed payload without enforcing a maximum decompressed size. A minimally sized compressed .gnumeric file can therefore expand to exceed the PHP memory limit, causing the process to crash during parsing. The vulnerability is exploitable when an attacker supplies a crafted .gnumeric file to an application that accepts arbitrary spreadsheet uploads, resulting in a service interruption. The weakness is classified under CWE-400 and CWE-409 – improper resource management and improper size restriction.

Affected Systems

The flaw exists in PHPOffice:PhpSpreadsheet versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5. Updated releases 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6 contain the fix.

Risk and Exploitability

The CVSS score is 7.5, indicating high severity, while the EPSS score is less than 1 %, showing a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploitation at this time. The most likely attack vector involves a user uploading a specially crafted .gnumeric file, which triggers the unbounded expansion during Gnumeric::canRead(), leading to a service crash before the file is rejected or parsed.

Generated by OpenCVE AI on August 4, 2026 at 12:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade PhpSpreadsheet to the latest fixed releases: 5.8.1 or newer, 3.10.7 or newer, 2.4.7 or newer, 2.1.18 or newer, or 1.30.6 or newer, depending on the version in use.
  • If an upgrade is not immediately possible, reduce the PHP memory_limit setting and implement a pre‑upload check that rejects files when gzdecode would exceed the configured memory threshold, thereby containing the impact of a potential denial‑of‑service attempt.
  • If Gnumeric files are not required for legitimate business operations, block acceptance of .gnumeric uploads at the application or web‑server layer; otherwise enforce a strict maximum file size and validate the decompressed data size before invoking the Gnumeric reader.

Generated by OpenCVE AI on August 4, 2026 at 12:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-2mrg-gjxq-2gvr PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
History

Wed, 29 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Phpoffice
Phpoffice phpspreadsheet
Vendors & Products Phpoffice
Phpoffice phpspreadsheet

Tue, 28 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.
Title PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Weaknesses CWE-400
CWE-409
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Phpoffice Phpspreadsheet
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-29T13:56:46.333Z

Reserved: 2026-07-07T18:20:06.126Z

Link: CVE-2026-59932

cve-icon Vulnrichment

Updated: 2026-07-29T13:56:35.359Z

cve-icon NVD

Status : Deferred

Published: 2026-07-28T19:17:39.590

Modified: 2026-07-30T19:33:00.343

Link: CVE-2026-59932

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T13:00:11Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)