Skip to content
Threat Feed
Subscribe

Product

PhpSpreadsheet (3.x Series, Versions >= 3.3.0, <= 3.10.6)

1 brief RSS
medium advisory

PHPSpreadsheet Denial of Service via Malformed XLS/OLE Sector Chain

PhpSpreadsheet's OLE reader contains a denial-of-service vulnerability where it fails to detect cycles in attacker-controlled XLS/OLE sector chains, leading to infinite loops and memory exhaustion when parsing specially crafted, small malformed XLS/OLE files, which can cause PHP workers to crash and deny service to web applications processing untrusted spreadsheet uploads.

PhpSpreadsheet +4 denial-of-service vulnerability php xls ole
1t