Zero Radar
← feed
HighVulnerabilityCVE-2026-108359updated 27 Oct 2026, 15:39 UTC

PhpSpreadsheet can be crashed by a tiny malicious spreadsheet file

A small specially crafted spreadsheet (.ods file) can make the PHP program that opens it use up all its memory and crash. Anyone who lets users upload or open such files can be hit by this.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes5.10.0, 3.10.8, 2.4.8, 2.1.19, 1.30.7 · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerCrafts a tiny malicious .ods file
  2. 2UploadFile is submitted to your application
  3. 3PhpSpreadsheet reads fileRow repeat count is not limited
  4. 4Memory exhaustedMillions of cells are created
  5. ResultPHP worker crashes, service disrupted

What happened

PhpSpreadsheet's OpenDocument Spreadsheet reader does not limit the table:number-rows-repeated attribute on table rows, so one row can be expanded into millions of cells, exhausting memory (fatal out-of-memory error).

Why it is dangerous: A roughly 1.4 KB file can stop a PHP worker or web request, causing denial of service for any application that loads user-supplied .ods files.

Are you affected?

You are affected if your application uses PhpSpreadsheet (composer phpoffice/phpspreadsheet) to read .ods files supplied by users or untrusted sources, in an affected version.

Package / productAffected versionsFixed in
phpoffice/phpspreadsheet · composer>= 4.0.0, <= 5.9.05.10.0
phpoffice/phpspreadsheet · composer>= 3.3.0, <= 3.10.73.10.8
phpoffice/phpspreadsheet · composer>= 2.2.0, <= 2.4.72.4.8
phpoffice/phpspreadsheet · composer>= 2.0.0, <= 2.1.182.1.19
phpoffice/phpspreadsheet · composer<= 1.30.61.30.7

What to do

  1. Update phpoffice/phpspreadsheet to 5.10.0, 3.10.8, 2.4.8, 2.1.19 or 1.30.7 depending on your branch
  2. Until updated, reject or do not load .ods files from untrusted users
  3. Set PHP memory limits and request timeouts so a single bad file cannot exhaust the server

Timeline

  1. 22 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 22 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 15:39 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 27 Oct 2026, 15:39 UTC
    Fixed version published: phpoffice/phpspreadsheet 5.10.0, phpoffice/phpspreadsheet 3.10.8, phpoffice/phpspreadsheet 2.4.8 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-108359 · GHSA-j2w7-387v-m2rq
CVSS
8.7 / 10
EPSS
0.7% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 18:17 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 15:39 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

PhpSpreadsheet can be crashed by a tiny malicious spreadsheet file · Zero Radar