Is CVE-2026-108359 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108359 being exploited in the wild.

How severe is CVE-2026-108359?

High severity, with a CVSS score of 4, published 22 October 2026.

Which products and versions are affected?

phpoffice/phpspreadsheet (Packagist) >= 4.0.0, <= 5.9.0, ECOSYSTEM:introduced=4.0.0,fixed=5.10.0; Phpoffice Phpspreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.

Is there a fix for CVE-2026-108359?

Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108359 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108359?

Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108359: PhpSpreadsheet denial-of-service via unbounded row repetition

Q: Is there a fix for CVE-2026-108359?

Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-108359 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-108359?

Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108359 · Severity: high · CVSS 4 · Published 2026-10-22

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. An attacker can craft a malicious ODS spreadsheet file with an unbounded table row repetition attribute that causes the library to consume excessive CPU and memory, crashing the PHP worker process. This affects applications that parse user-supplied ODS files without validation.

Technologies: phpoffice/phpspreadsheet (Packagist), Phpoffice Phpspreadsheet. Vendors: Packagist, Phpoffice.

Quick answers

Is CVE-2026-108359 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108359 being exploited in the wild.
How severe is CVE-2026-108359?: High severity, with a CVSS score of 4, published 22 October 2026.
Which products and versions are affected?: phpoffice/phpspreadsheet (Packagist) >= 4.0.0, <= 5.9.0, ECOSYSTEM:introduced=4.0.0,fixed=5.10.0; Phpoffice Phpspreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
Is there a fix for CVE-2026-108359?: Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108359 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108359?: Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phpoffice/phpspreadsheet (Packagist): upgrade to 5.10.0 or later
```
composer require phpoffice/phpspreadsheet:^5.10.0
```

Technical details

The Ods::processTableRow method in src/PhpSpreadsheet/Reader/Ods.php fails to validate the table:number-rows-repeated attribute, allowing an attacker to specify an arbitrarily large repetition count. When a row contains a value, the reader materializes a cell for every repetition without checking against the spreadsheet row limit, causing unbounded memory and CPU consumption. A small ODS file can trigger a denial-of-service condition on the PHP worker.

Affected products

PHPOffice PhpSpreadsheet before 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0

Identifiers

CVE-2026-108359
GHSA-j2w7-387v-m2rq

Timeline

2026-10-22: disclosed
2026-09-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.