CVE-2026-59933

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet (affected versions not specified)

Description The OLE reader in PhpSpreadsheet follows sector chains from XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A malformed file can set the small-block depot sector chain to point back to itself, causing the OLERead::read() function to append the same sector data repeatedly. This leads to memory exhaustion and a denial of service. The issue is reachable via ReaderXls::canRead() and automatic spreadsheet type detection, meaning applications accepting spreadsheet uploads are at risk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.