Junglewise Threat Intelligence

CVE-2026-59932: PHPOffice PhpSpreadsheet denial of service via Gnumeric gzip expansion

CVE-2026-59932 · Severity: high · CVSS 7.5 · Published 2026-07-28

Technologies: Phpoffice Phpspreadsheet. Vendors: Phpoffice.

Executive brief

PhpSpreadsheet, a popular PHP library used to read and write spreadsheet files, is vulnerable to a denial-of-service attack. An attacker can upload a specially crafted, highly compressed Gnumeric file that, when processed, expands to a size that exceeds the server's memory limits. This causes the application to crash, potentially disrupting business operations and service availability for all users.

Technical details

A vulnerability exists in the Gnumeric reader of PhpSpreadsheet due to improper handling of highly compressed data (CWE-409). When the reader encounters a .gnumeric file starting with gzip magic bytes, it calls gzdecode() on the full contents without enforcing a decompressed-size limit. This allows a 'zip bomb' style attack where a small malicious file expands to exceed the PHP memory_limit, crashing the process during the Gnumeric::canRead() call. The issue is reachable through standard file-type detection and loading paths. Patches have been released in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.

Affected products

  • PHPOffice PhpSpreadsheet 4.0.0 - 5.8.0, 3.3.0 - 3.10.6, 2.2.0 - 2.4.6, 2.0.0 - 2.1.17, <= 1.30.5

Timeline

  • 2026-07-11: patched: Fix committed to repository
  • 2026-07-28: advisory: NVD and GitHub advisory published

References

Related threats