CVE-2026-40863
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
75/100
Published: 2026-05-12
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader (Reader\Xml) does not validate the ss:Index row attribute against the maximum allowed row count (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a SpreadsheetML XML file with ss:Index="999999999" on a <Row> element, which inflates the internal cachedHighestRow to ~1 billion. Any subsequent call to getRowIterator() without an explicit end row will attempt to iterate ~1 billion rows, causing CPU exhaustion and denial of service. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
Weakness Classification (1)
Affected Software (5)
| Vendor | Product | Version |
|---|---|---|
| phpoffice | phpspreadsheet | < 1.30.4 |
| phpoffice | phpspreadsheet | 2.0.0 – 2.1.16 |
| phpoffice | phpspreadsheet | 2.2.0 – 2.4.5 |
| phpoffice | phpspreadsheet | 3.3.0 – 3.10.5 |
| phpoffice | phpspreadsheet | 4.0.0 – 5.7.0 |
References & Advisories (1)
Exploit
Mitigation
Vendor Advisory