{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/phpspreadsheet-3.x-series-versions--3.3.0--3.10.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PhpSpreadsheet (4.x series, versions \u003e= 4.0.0, \u003c= 5.8.0)","PhpSpreadsheet (3.x series, versions \u003e= 3.3.0, \u003c= 3.10.6)","PhpSpreadsheet (2.x series, versions \u003e= 2.2.0, \u003c= 2.4.6)","PhpSpreadsheet (2.x series, versions \u003e= 2.0.0, \u003c= 2.1.17)","PhpSpreadsheet (1.x series, versions \u003c= 1.30.5)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","php","xls","ole"],"_cs_type":"advisory","_cs_vendors":["PhpOffice"],"content_html":"\u003cp\u003eA denial-of-service vulnerability, identified as CVE-2026-59933, affects multiple versions of PhpSpreadsheet, a popular PHP library used for reading and writing spreadsheet files. The vulnerability stems from a flaw in the \u003ccode\u003eOLERead::read()\u003c/code\u003e function, which is responsible for parsing OLE (Object Linking and Embedding) structured storage files, such as older \u003ccode\u003e.xls\u003c/code\u003e format spreadsheets. The parser fails to detect cyclic references within attacker-controlled sector chains present in malformed OLE files, specifically in the small-block depot sector chain. This oversight causes the \u003ccode\u003eread()\u003c/code\u003e function to enter an infinite loop, continuously appending the same sector data until the PHP process exhausts its allocated memory, leading to a fatal error and application crash. This issue is critically reachable during automatic spreadsheet type detection (\u003ccode\u003eXls::canRead()\u003c/code\u003e), meaning even an attempt to identify the file type can trigger the vulnerability, bypassing deeper validation checks. The vulnerability impacts web applications, queue workers, preview services, or document converters that process untrusted spreadsheet uploads, as a tiny 1 KiB malformed file can effectively take down a PHP worker.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a small, malformed \u003ccode\u003e.xls\u003c/code\u003e/OLE file (e.g., 1 KiB in size).\u003c/li\u003e\n\u003cli\u003eThe attacker manipulates the OLE header and allocation table values to create a self-loop in the small-block depot sector chain, specifically by setting a sector entry to point back to itself.\u003c/li\u003e\n\u003cli\u003eThe victim's application, using the PhpSpreadsheet library, attempts to process an untrusted spreadsheet upload.\u003c/li\u003e\n\u003cli\u003eThe application invokes \u003ccode\u003ePhpOffice\\PhpSpreadsheet\\IOFactory::createReaderForFile()\u003c/code\u003e or directly calls \u003ccode\u003ePhpOffice\\PhpSpreadsheet\\Reader\\Xls::canRead()\u003c/code\u003e or \u003ccode\u003eloadOLE()\u003c/code\u003e to detect or load the file.\u003c/li\u003e\n\u003cli\u003eDuring this process, \u003ccode\u003ePhpOffice\\PhpSpreadsheet\\Shared\\OLERead::read()\u003c/code\u003e is called to parse the OLE structure.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eOLERead::read()\u003c/code\u003e function encounters the maliciously crafted cyclic sector chain and enters an unbounded loop, continuously trying to read the same sector data.\u003c/li\u003e\n\u003cli\u003eThe PHP process rapidly exhausts its memory limit, leading to a fatal memory exhaustion error and crashing the PHP worker handling the request.\u003c/li\u003e\n\u003cli\u003eThe crash results in a denial of service for the web application or service, making it unavailable to legitimate users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful exploitation of CVE-2026-59933 can lead to a denial-of-service condition across various applications and services that utilize PhpSpreadsheet to process untrusted files. A file as small as 1 KiB can crash a PHP worker during file detection or loading, potentially rendering web applications, queue processing services, document preview services, or conversion tools unresponsive. This vulnerability bypasses typical validation checks because it triggers at the initial stage of file type detection. The observed damage includes PHP fatal errors due to memory exhaustion, leading to service disruption and unavailability for end-users. The potential number of victims is broad, encompassing any organization or developer using affected versions of PhpSpreadsheet in an environment that handles external spreadsheet uploads.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize patching all affected PhpSpreadsheet installations to a fixed version immediately. This addresses CVE-2026-59933 directly.\u003c/li\u003e\n\u003cli\u003eImplement robust input validation and sanitization for all uploaded files, especially those processed by libraries like PhpSpreadsheet.\u003c/li\u003e\n\u003cli\u003eMonitor PHP process memory usage closely, specifically for instances handling file uploads, to detect unusual spikes that could indicate an attempted denial-of-service attack related to CVE-2026-59933.\u003c/li\u003e\n\u003cli\u003eConfigure \u003ccode\u003ememory_limit\u003c/code\u003e in \u003ccode\u003ephp.ini\u003c/code\u003e to a reasonable maximum for web workers to prevent single requests from consuming excessive resources, while understanding this mitigates symptoms, not the root cause.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T15:11:39Z","date_published":"2026-07-23T15:11:39Z","id":"https://feed.craftedsignal.io/briefs/2026-07-phpspreadsheet-dos/","summary":"PhpSpreadsheet's OLE reader contains a denial-of-service vulnerability where it fails to detect cycles in attacker-controlled XLS/OLE sector chains, leading to infinite loops and memory exhaustion when parsing specially crafted, small malformed XLS/OLE files, which can cause PHP workers to crash and deny service to web applications processing untrusted spreadsheet uploads.","title":"PHPSpreadsheet Denial of Service via Malformed XLS/OLE Sector Chain","url":"https://feed.craftedsignal.io/briefs/2026-07-phpspreadsheet-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - PhpSpreadsheet (3.x Series, Versions \u003e= 3.3.0, \u003c= 3.10.6)","version":"https://jsonfeed.org/version/1.1"}