# CVE-2026-59932: PHPOffice PhpSpreadsheet denial of service via Gnumeric gzip expansion

Source: https://junglewise.ai/threats/cve-2026-59932-phpoffice-phpspreadsheet-denial-of-service-via-gnumeric-gzip  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-59932 · Severity: high · CVSS 7.5 · Published 2026-07-28

PhpSpreadsheet, a popular PHP library used to read and write spreadsheet files, is vulnerable to a denial-of-service attack. An attacker can upload a specially crafted, highly compressed Gnumeric file that, when processed, expands to a size that exceeds the server's memory limits. This causes the application to crash, potentially disrupting business operations and service availability for all users.

Technologies: [phpoffice/phpspreadsheet (Packagist)](https://junglewise.ai/threats/technologies/phpoffice-phpspreadsheet), [Phpoffice Phpspreadsheet](https://junglewise.ai/threats/technologies/phpspreadsheet). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Phpoffice](https://junglewise.ai/threats/vendors/phpoffice).

## Quick answers

**Is CVE-2026-59932 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59932 being exploited in the wild.

**How severe is CVE-2026-59932?** High severity, with a CVSS score of 7.5, published 28 July 2026.

**Which products and versions are affected?** phpoffice/phpspreadsheet (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.8.1; Phpoffice Phpspreadsheet <= 1.30.5, >= 2.0.0, <= 2.1.17, >= 2.2.0, <= 2.4.6, >= 3.3.0, <= 3.10.6, >= 4.0.0, <= 5.8.0, 4.0.0 - 5.8.0, 3.3.0 - 3.10.6, 2.2.0 - 2.4.6, 2.0.0 - 2.1.17, <= 1.30.5.

**Is there a fix for CVE-2026-59932?** Yes. phpoffice/phpspreadsheet (Packagist): upgrade to 5.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59932 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59932?** Check whether you run phpoffice/phpspreadsheet (Packagist) or Phpoffice Phpspreadsheet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpoffice/phpspreadsheet (Packagist): upgrade to 5.8.1 or later

  ```sh
  composer require phpoffice/phpspreadsheet:^5.8.1
  ```


## Technical details

A vulnerability exists in the Gnumeric reader of PhpSpreadsheet due to improper handling of highly compressed data (CWE-409). When the reader encounters a .gnumeric file starting with gzip magic bytes, it calls gzdecode() on the full contents without enforcing a decompressed-size limit. This allows a 'zip bomb' style attack where a small malicious file expands to exceed the PHP memory_limit, crashing the process during the Gnumeric::canRead() call. The issue is reachable through standard file-type detection and loading paths. Patches have been released in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.

## Affected products

- PHPOffice PhpSpreadsheet 4.0.0 - 5.8.0, 3.3.0 - 3.10.6, 2.2.0 - 2.4.6, 2.0.0 - 2.1.17, <= 1.30.5

## Identifiers

- CVE-2026-59932
- GHSA-2mrg-gjxq-2gvr

## Timeline

- 2026-07-11: patched: Fix committed to repository
- 2026-07-28: advisory: NVD and GitHub advisory published

## References

- [https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750](https://github.com/PHPOffice/PhpSpreadsheet/commit/85f2556b0bf5269061bf45932ecda8a128d81750)
- [https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6](https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6)
- [https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18](https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18)
- [https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7](https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7)
- [https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7](https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7)
- [https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1](https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1)
- [https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2mrg-gjxq-2gvr](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-2mrg-gjxq-2gvr)

## Related threats

- [PHPOffice PhpSpreadsheet redirect validation bypass in external image loading](https://junglewise.ai/threats/cve-2026-108360-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet denial-of-service via unbounded row repetition](https://junglewise.ai/threats/cve-2026-108359-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PhpSpreadsheet XmlScanner XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108358-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [PHPOffice PhpSpreadsheet XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-108357-phpspreadsheet-is-a-pure-php-library-for-reading-and-writing)
- [MediaWiki DataTransfer Extension uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-100242-dependency-on-vulnerable-third-party-component-and-uncontrolled)