CVE-2026-40902: PHPOffice PhpSpreadsheet CPU denial of service in XLSX reader

CVE-2026-40902 · Severity: high · CVSS 7.5 · Published 2026-05-12

PhpSpreadsheet is a widely used PHP library for reading and writing spreadsheet files, often used by web applications to process user-uploaded data. A vulnerability in how it handles XLSX files allows an attacker to provide a specially crafted, very small file that forces the server to perform billions of unnecessary calculations. This can lead to a denial-of-service (DoS) condition, where the server's CPU resources are exhausted, making the application unresponsive to legitimate users.

Technologies: phpoffice/phpspreadsheet (Packagist), Phpoffice Phpspreadsheet. Vendors: Packagist, Phpoffice.

Quick answers

Is CVE-2026-40902 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40902 being exploited in the wild.
How severe is CVE-2026-40902?
High severity, with a CVSS score of 7.5, published 12 May 2026.
Which products and versions are affected?
phpoffice/phpspreadsheet (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.7.0; Phpoffice Phpspreadsheet < 1.30.4, >= 2.0.0, < 2.1.16, >= 2.2.0, < 2.4.5, >= 3.3.0, < 3.10.5, >= 4.0.0, < 5.7.0, >= 4.0.0, <= 5.6.0; >= 3.3.0, <= 3.10.4; >= 2.2.0, <= 2.4.4; >= 2.0.0, <= 2.1.15; <= 1.30.3.
Is there a fix for CVE-2026-40902?
Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40902 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40902?
Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later
    composer require phpoffice/phpspreadsheet:^5.7.0

Technical details

A CPU denial-of-service vulnerability exists in the PhpSpreadsheet XLSX reader's ColumnAndRowAttributes::readRowAttributes() method. The library reads row numbers from XML attributes without validating them against the maximum row limit (1,048,576). An attacker can craft a minimal XLSX file containing a row attribute with an extremely high value (e.g., 999,999,999), which inflates the 'cachedHighestRow' property. Subsequent row iterations using getRowIterator() or loops bounded by getHighestRow() will attempt to execute approximately 1 billion cycles, exhausting CPU resources. The vulnerability is fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0 by adding bounds checking to the row index.

Affected products

  • PHPOffice phpoffice/phpspreadsheet < 1.30.4, >= 2.0.0, < 2.1.16, >= 2.2.0, < 2.4.5, >= 3.3.0, < 3.10.5, >= 4.0.0, < 5.7.0

Identifiers

  • CVE-2026-40902
  • GHSA-7c6m-4442-2x6m

Timeline

  • 2026-04-28: advisory: GitHub security advisory published by maintainers
  • 2026-05-12: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.