CVE-2026-40902 PHPOffice CVE debrief

Who should care

PhpSpreadsheet users, developers, and administrators who use PhpSpreadsheet in their applications should assess their exposure and prioritize upgrading to a fixed version to prevent potential DoS attacks.

Why it matters

CVE-2026-40902 is a high-severity vulnerability in PhpSpreadsheet that can lead to a denial-of-service (DoS) attack. PhpSpreadsheet users should prioritize upgrading to a fixed version to prevent potential DoS attacks. The vulnerability is caused by the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method not validating row numbers from XML attributes against the spreadsheet maximum row limit. The vulnerability is fixed in PhpSpreadsheet versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

• Denial of Service (DoS) due to excessive CPU resource consumption
• Potential for significant performance degradation or system crashes

Technical summary

The XLSX reader's ColumnAndRowAttributes::readRowAttributes() method in PhpSpreadsheet does not validate row numbers from XML attributes against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r='999999999'/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources.

Defensive priority

PhpSpreadsheet users should prioritize upgrading to a fixed version to prevent potential DoS attacks.

Recommended defensive actions

• Upgrade to PhpSpreadsheet version 1.30.4, 2.1.16, 2.4.5, 3.10.5, or 5.7.0 or later
• Validate and sanitize row numbers from XML attributes in XLSX files
• Implement resource limits for CPU-intensive operations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method not validating row numbers from XML attributes against the spreadsheet maximum row limit. An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r='999999999'/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.