CVE-2026-59933 PHPOffice CVE debrief

Who should care

Defenders of applications that accept attacker-controlled spreadsheet uploads should assess exposure and prioritize patching or mitigating this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of spreadsheet processing within their environments.

Why it matters

CVE-2026-59933 is a denial-of-service vulnerability in PhpSpreadsheet that can be triggered by a tiny malformed .xls/OLE file. Defenders of applications that accept spreadsheet uploads should assess exposure, prioritize patching, and implement mitigations to prevent service disruption.

• Denial of service through memory exhaustion
• Potential for service disruption or degradation
• Need for patching or mitigation to prevent exploitation
• Verification of affected versions and deployments required

Technical summary

The OLE reader in PhpSpreadsheet follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can cause a denial of service by exhausting memory during normal XLS detection. This vulnerability affects versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5. Defenders should assess exposure and prioritize patching or mitigating this vulnerability, especially in applications that accept attacker-controlled spreadsheet uploads.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in applications that accept attacker-controlled spreadsheet uploads.

Recommended defensive actions

• Patch PhpSpreadsheet to version 5.8.1, 3.10.7, 2.4.7, 2.1.18, or 1.30.6
• Restrict spreadsheet uploads to trusted sources
• Implement memory limits and monitoring for spreadsheet processing
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. However, the scope of affected deployments and potential impact on specific systems require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.