# CVE-2026-40902: PHPOffice PhpSpreadsheet CPU denial of service in XLSX reader

Source: https://junglewise.ai/threats/cve-2026-40902-phpoffice-phpspreadsheet-cpu-denial-of-service-in-xlsx-reader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-40902 · Severity: high · CVSS 7.5 · Published 2026-05-12

PhpSpreadsheet is a widely used PHP library for reading and writing spreadsheet files, often used by web applications to process user-uploaded data. A vulnerability in how it handles XLSX files allows an attacker to provide a specially crafted, very small file that forces the server to perform billions of unnecessary calculations. This can lead to a denial-of-service (DoS) condition, where the server's CPU resources are exhausted, making the application unresponsive to legitimate users.

Technologies: [phpoffice/phpspreadsheet (Packagist)](https://junglewise.ai/threats/technologies/phpoffice-phpspreadsheet), [Phpoffice Phpspreadsheet](https://junglewise.ai/threats/technologies/phpspreadsheet). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Phpoffice](https://junglewise.ai/threats/vendors/phpoffice).

## Quick answers

**Is CVE-2026-40902 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40902 being exploited in the wild.

**How severe is CVE-2026-40902?** High severity, with a CVSS score of 7.5, published 12 May 2026.

**Which products and versions are affected?** phpoffice/phpspreadsheet (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.7.0; Phpoffice Phpspreadsheet < 1.30.4, >= 2.0.0, < 2.1.16, >= 2.2.0, < 2.4.5, >= 3.3.0, < 3.10.5, >= 4.0.0, < 5.7.0, >= 4.0.0, <= 5.6.0; >= 3.3.0, <= 3.10.4; >= 2.2.0, <= 2.4.4; >= 2.0.0, <= 2.1.15; <= 1.30.3.

**Is there a fix for CVE-2026-40902?** Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40902 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40902?** Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpoffice/phpspreadsheet (Packagist): upgrade to 5.7.0 or later

  ```sh
  composer require phpoffice/phpspreadsheet:^5.7.0
  ```


## Technical details

A CPU denial-of-service vulnerability exists in the PhpSpreadsheet XLSX reader's ColumnAndRowAttributes::readRowAttributes() method. The library reads row numbers from XML attributes without validating them against the maximum row limit (1,048,576). An attacker can craft a minimal XLSX file containing a row attribute with an extremely high value (e.g., 999,999,999), which inflates the 'cachedHighestRow' property. Subsequent row iterations using getRowIterator() or loops bounded by getHighestRow() will attempt to execute approximately 1 billion cycles, exhausting CPU resources. The vulnerability is fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0 by adding bounds checking to the row index.

## Affected products

- PHPOffice phpoffice/phpspreadsheet < 1.30.4, >= 2.0.0, < 2.1.16, >= 2.2.0, < 2.4.5, >= 3.3.0, < 3.10.5, >= 4.0.0, < 5.7.0

## Identifiers

- CVE-2026-40902
- GHSA-7c6m-4442-2x6m

## Timeline

- 2026-04-28: advisory: GitHub security advisory published by maintainers
- 2026-05-12: disclosed: NVD publication date

## References

- [https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7c6m-4442-2x6m](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7c6m-4442-2x6m)

## Related threats

- [PHPOffice PhpSpreadsheet redirect validation bypass in external image loading](https://junglewise.ai/threats/cve-2026-108360-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet denial-of-service via unbounded row repetition](https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet XmlScanner XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PHPOffice PhpSpreadsheet XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [MediaWiki DataTransfer Extension uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-100242-dependency-on-vulnerable-third-party-component-and-uncontrolled)