CVE-2026-59933

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59933", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-07T18:20:06.126Z", "datePublished": "2026-07-28T17:29:27.129Z", "dateUpdated": "2026-07-28T17:57:30.912Z"}, "containers": {"cna": {"title": "PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-835", "lang": "en", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"}, {"name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"}], "affected": [{"vendor": "PHPOffice", "product": "PhpSpreadsheet", "versions": [{"version": ">= 4.0.0, < 5.8.1", "status": "affected"}, {"version": ">= 3.3.0, < 3.10.7", "status": "affected"}, {"version": ">= 2.2.0, < 2.4.7", "status": "affected"}, {"version": ">= 2.0.0, < 2.1.18", "status": "affected"}, {"version": "< 1.30.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T17:29:27.129Z"}, "descriptions": [{"lang": "en", "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6."}], "source": {"advisory": "GHSA-xh5m-36r6-47m3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T17:57:16.033236Z", "id": "CVE-2026-59933", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T17:57:30.912Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59933", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T17:57:16.033236Z"}}}], "references": [{"url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T17:57:27.458Z"}}], "cna": {"title": "PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion", "source": {"advisory": "GHSA-xh5m-36r6-47m3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "PHPOffice", "product": "PhpSpreadsheet", "versions": [{"status": "affected", "version": ">= 4.0.0, < 5.8.1"}, {"status": "affected", "version": ">= 3.3.0, < 3.10.7"}, {"status": "affected", "version": ">= 2.2.0, < 2.4.7"}, {"status": "affected", "version": ">= 2.0.0, < 2.1.18"}, {"status": "affected", "version": "< 1.30.6"}]}], "references": [{"url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3", "name": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750", "name": "https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6", "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18", "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7", "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7", "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1", "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T17:29:27.129Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59933", "state": "PUBLISHED", "dateUpdated": "2026-07-28T17:57:30.912Z", "dateReserved": "2026-07-07T18:20:06.126Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-28T17:29:27.129Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "PhpSpreadsheet", "vendor": "PHPOffice", "versions": [{"status": "affected", "version": ">= 4.0.0, < 5.8.1"}, {"status": "affected", "version": ">= 3.3.0, < 3.10.7"}, {"status": "affected", "version": ">= 2.2.0, < 2.4.7"}, {"status": "affected", "version": ">= 2.0.0, < 2.1.18"}, {"status": "affected", "version": "< 1.30.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6."}, {"lang": "es", "value": "PhpSpreadsheet es una biblioteca PHP pura para leer y escribir archivos de hoja de c\u00e1lculo. En las versiones 4.0.0 hasta 5.8.0, 3.3.0 hasta 3.10.6, 2.2.0 hasta 2.4.6, 2.0.0 hasta 2.1.17, y todas las versiones hasta la 1.30.5 inclusive, el lector OLE sigue cadenas de sectores desde metadatos XLS/OLE controlados por el atacante sin detectar ciclos o imponer una longitud m\u00e1xima de cadena. Un archivo .xls/OLE malformado muy peque\u00f1o puede hacer que la cadena de sectores del dep\u00f3sito de bloques peque\u00f1os apunte de nuevo a s\u00ed misma. Durante la detecci\u00f3n normal de XLS, OLERead::read() a\u00f1ade los mismos datos de sector repetidamente hasta que el proceso PHP agota la memoria. Esto es accesible desde Reader\\Xls::canRead() y, por lo tanto, desde la detecci\u00f3n autom\u00e1tica del tipo de hoja de c\u00e1lculo. Las aplicaciones que aceptan cargas de hojas de c\u00e1lculo controladas por el atacante pueden sufrir denegaci\u00f3n de servicio a partir de un archivo muy peque\u00f1o. Este problema ha sido solucionado en las versiones 5.8.1, 3.10.7, 2.4.7, 2.1.18 y 1.30.6."}], "id": "CVE-2026-59933", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59933", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T17:57:16.033236Z", "version": "2.0.3"}}]}, "published": "2026-07-28T18:17:23.033", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-835"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,5.8.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.3.0,3.10.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0,2.4.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.1.18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.30.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PhpSpreadsheet", "source": "cna", "vendor": "PHPOffice"}, "product": "phpspreadsheet", "vendor": "phpoffice"}], "created": "2026-07-28T19:30:16.648042+00:00", "updated": "2026-08-03T14:45:04.295992+00:00", "vendors": ["phpoffice", "phpoffice$PRODUCT$phpspreadsheet"]}