Vulnerability · Published Jul 28, 2026 · Assigned by GitHub_M
CVE-2026-59932PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
High 7.5
In plain English
A high-severity uncontrolled resource consumption in PhpSpreadsheet from PHPOffice. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | phpoffice/phpspreadsheet | 5.8.1 | GHSA-2mrg-gjxq-2gvr |
| Packagist | phpoffice/phpspreadsheet | 3.10.7 | GHSA-2mrg-gjxq-2gvr |
| Packagist | phpoffice/phpspreadsheet | 2.4.7 | GHSA-2mrg-gjxq-2gvr |
| Packagist | phpoffice/phpspreadsheet | 2.1.18 | GHSA-2mrg-gjxq-2gvr |
| Packagist | phpoffice/phpspreadsheet | 1.30.6 | GHSA-2mrg-gjxq-2gvr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHPOffice | PhpSpreadsheet | >= 4.0.0, < 5.8.1>= 3.3.0, < 3.10.7>= 2.2.0, < 2.4.7>= 2.0.0, < 2.1.18< 1.30.6 |
Weakness: CWE-400, CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2mrg-gjxq-2gvr x_refsource_CONFIRM
- https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7 x_refsource_MISC
- https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1 x_refsource_MISC