CVE-2026-59933

{
  "id": "CVE-2026-59933",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-28T18:17:23.033",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6."
    },
    {
      "lang": "es",
      "value": "PhpSpreadsheet es una biblioteca PHP pura para leer y escribir archivos de hoja de cálculo. En las versiones 4.0.0 hasta 5.8.0, 3.3.0 hasta 3.10.6, 2.2.0 hasta 2.4.6, 2.0.0 hasta 2.1.17, y todas las versiones hasta la 1.30.5 inclusive, el lector OLE sigue cadenas de sectores desde metadatos XLS/OLE controlados por el atacante sin detectar ciclos o imponer una longitud máxima de cadena. Un archivo .xls/OLE malformado muy pequeño puede hacer que la cadena de sectores del depósito de bloques pequeños apunte de nuevo a sí misma. Durante la detección normal de XLS, OLERead::read() añade los mismos datos de sector repetidamente hasta que el proceso PHP agota la memoria. Esto es accesible desde Reader\\Xls::canRead() y, por lo tanto, desde la detección automática del tipo de hoja de cálculo. Las aplicaciones que aceptan cargas de hojas de cálculo controladas por el atacante pueden sufrir denegación de servicio a partir de un archivo muy pequeño. Este problema ha sido solucionado en las versiones 5.8.1, 3.10.7, 2.4.7, 2.1.18 y 1.30.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "PHPOffice",
          "product": "PhpSpreadsheet",
          "versions": [
            {
              "version": ">= 4.0.0, < 5.8.1",
              "status": "affected"
            },
            {
              "version": ">= 3.3.0, < 3.10.7",
              "status": "affected"
            },
            {
              "version": ">= 2.2.0, < 2.4.7",
              "status": "affected"
            },
            {
              "version": ">= 2.0.0, < 2.1.18",
              "status": "affected"
            },
            {
              "version": "< 1.30.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-28T17:57:16.033236Z",
          "id": "CVE-2026-59933",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}