PhpSpreadsheet processes XLS/OLE spreadsheets by following sector chains present in the file’s metadata. In affected releases the library does not detect cycles or limit the length of a sector chain, allowing a crafted file to create a self‑loop that causes the reader to repeatedly load the same sector data until the PHP process runs out of memory. This results in a denial of service that can be triggered with a very small spreadsheet file, exhausting server resources or crashing the application.

The vulnerability affects PHPOffice PhpSpreadsheet in many version ranges, specifically from 1.30.0 through 1.30.5, 2.0.0 through 2.1.17, 2.2.0 through 2.4.6, 3.3.0 through 3.10.6, and 4.0.0 through 5.8.0. Any application that incorporates one of these releases and accepts user‑supplied spreadsheet files is potentially impacted.

Although the EPSS score indicates a very low exploitation probability (<1%) and the vulnerability is not listed in CISA’s KEV catalog, the CVSS score of 7.5 reflects a severe denial of service risk if an attacker can submit a malicious spreadsheet. The attack vector is inferred to be the ingestion of attacker‑controlled spreadsheet uploads that are automatically detected by PhpSpreadsheet’s type detection. Once the library attempts to read the file, the self‑loop leads to uncontrolled memory consumption and crash, fulfilling both CWE‑400 (Uncontrolled Resource Consumption) and CWE‑835 (Infinite Loop).