CVE-2026-59932: PHPOffice PhpSpreadsheet denial of service via Gnumeric gzip expansion

CVE-2026-59932 · Severity: high · CVSS 7.5 · Published 2026-07-28

PhpSpreadsheet, a popular PHP library used to read and write spreadsheet files, is vulnerable to a denial-of-service attack. An attacker can upload a specially crafted, highly compressed Gnumeric file that, when processed, expands to a size that exceeds the server's memory limits. This causes the application to crash, potentially disrupting business operations and service availability for all users.

Technologies: phpoffice/phpspreadsheet (Packagist), Phpoffice Phpspreadsheet. Vendors: Packagist, Phpoffice.

Quick answers

Is CVE-2026-59932 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59932 being exploited in the wild.
How severe is CVE-2026-59932?
High severity, with a CVSS score of 7.5, published 28 July 2026.
Which products and versions are affected?
phpoffice/phpspreadsheet (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.8.1; Phpoffice Phpspreadsheet <= 1.30.5, >= 2.0.0, <= 2.1.17, >= 2.2.0, <= 2.4.6, >= 3.3.0, <= 3.10.6, >= 4.0.0, <= 5.8.0, 4.0.0 - 5.8.0, 3.3.0 - 3.10.6, 2.2.0 - 2.4.6, 2.0.0 - 2.1.17, <= 1.30.5.
Is there a fix for CVE-2026-59932?
Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59932 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59932?
Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpoffice/phpspreadsheet (Packagist): upgrade to 5.8.1 or later
    composer require phpoffice/phpspreadsheet:^5.8.1

Technical details

A vulnerability exists in the Gnumeric reader of PhpSpreadsheet due to improper handling of highly compressed data (CWE-409). When the reader encounters a .gnumeric file starting with gzip magic bytes, it calls gzdecode() on the full contents without enforcing a decompressed-size limit. This allows a 'zip bomb' style attack where a small malicious file expands to exceed the PHP memory_limit, crashing the process during the Gnumeric::canRead() call. The issue is reachable through standard file-type detection and loading paths. Patches have been released in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.

Affected products

  • PHPOffice PhpSpreadsheet 4.0.0 - 5.8.0, 3.3.0 - 3.10.6, 2.2.0 - 2.4.6, 2.0.0 - 2.1.17, <= 1.30.5

Identifiers

  • CVE-2026-59932
  • GHSA-2mrg-gjxq-2gvr

Timeline

  • 2026-07-11: patched: Fix committed to repository
  • 2026-07-28: advisory: NVD and GitHub advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.