ZDF
Sign inSign up

Vulnerabilities

Security research · CVE-2026-108359

PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

Published Oct 22, 2026 · catalog updated Oct 27, 2026 · PHPOffice PhpSpreadsheet

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-108359. EPSS is 0.66%. Act only if a listed version of PHPOffice PhpSpreadsheet is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
High8.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.66%
Remediation
Version ranges on file
Affected products
Packagist phpoffice/phpspreadsheet · composer phpoffice · composer phpoffice/phpspreadsheet · vendor PHPOffice PhpSpreadsheet

## Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet ( ), reads the attribute of a with an unchecked cast, then materialises one cell per repeated row. This value is **completely unbounded**, so a **single ~1.4 KB file** can instruct the reader to create up to **millions of cells**, exhausting memory (fatal OOM). No authentication, no special configuration, and the default read filter are required - any application that loads a user-supplied is affected. --- ## Affected versions The expansion has existed in the ODS reader since its inception (pre-dating the current release branches), so all maintained lines are affected. | Branch | Affected | |--------|----------| | 1.x | ≤ 1.30.6 | | 2.0–2.1 | ≤ 2.1.18 | | 2.2–2.4 | ≤ 2.4.7 | | 3.x | ≤ 3.10.7 | | 4.x–5.x | ≤ 5.9.0 (latest) | --- ## Root cause (source → sink) : **Why columns are NOT vulnerable (already bounded):** The column-header loop at line 1326 shows the correct pattern with bounds checking: Additionally, the cell-data column loop at line 1141 calls which throws exception at when column exceeds (XFD / 16,384): **Result:** Columns are capped at 16,384. Only rows are unbounded. --- ## Impact **Memory exhaustion (single valued cell, repeated many rows):** A non-null cell value with a huge attribute materialises millions of objects → PHP fatal . **Example:** - Payload: (5 million rows) - File size: 1.4 KB - Memory consumed: ~256 MB (one Cell object per row) - Result: OOM at default memory limit --- ## Reproduction **Vulnerable payload (causes OOM):** **Not vulnerable (for reference - throws exception):** This column-repeat example throws exception (bounded defense, already in place).

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Packagist phpoffice/phpspreadsheet0 → 1.30.7
  • Packagist phpoffice/phpspreadsheet2.0.0 → 2.1.19
  • Packagist phpoffice/phpspreadsheet2.2.0 → 2.4.8
  • Packagist phpoffice/phpspreadsheet3.3.0 → 3.10.8
  • Packagist phpoffice/phpspreadsheet4.0.0 → 5.10.0
  • composer phpofficeversion unspecified
  • composer phpoffice/phpspreadsheet<= 1.30.6
  • composer phpoffice/phpspreadsheet>= 2.0.0, <= 2.1.18
  • composer phpoffice/phpspreadsheet>= 2.2.0, <= 2.4.7
  • composer phpoffice/phpspreadsheet>= 3.3.0, <= 3.10.7
  • composer phpoffice/phpspreadsheet>= 4.0.0, <= 5.9.0
  • vendor PHPOffice PhpSpreadsheetversion unspecified

How to fix CVE-2026-108359

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-108359. EPSS is 0.66%. Act only if a listed version of PHPOffice PhpSpreadsheet is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.30.7, 2.0.0 → 2.1.19, 2.2.0 → 2.4.8, 3.3.0 → 3.10.8, 4.0.0 → 5.10.0, <= 1.30.6. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption; CWE-789. EPSS 0.66%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 27, 2026 · GitHub Advisory Database

    Detected

    ## Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet ( ), reads the attribute of a with an unchecked cast, then materialises one cell per repeated row. This value is **completely unbounded**, so a **single ~1.4 KB file** can instruct the reader to create up to **millions of cells**, exhausting memory (fatal OOM). No authentication, no special configuration, and the default read filter

  2. Oct 27, 2026 · GitHub Advisory Database

    Updated

    ## Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet ( ), reads the attribute of a with an unchecked cast, then materialises one cell per repeated row. This value is **completely unbounded**, so a **single ~1.4 KB file** can instruct the reader to create up to **millions of cells**, exhausting memory (fatal OOM). No authentication, no special configuration, and the default read filter

  3. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    phpoffice/phpspreadsheet fixed in 5.10.0; phpoffice/phpspreadsheet fixed in 3.10.8; phpoffice/phpspreadsheet fixed in 2.4.8; phpoffice/phpspreadsheet fixed in 2.1.19

  4. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    phpoffice/phpspreadsheet fixed in 5.10.0

  5. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    phpoffice/phpspreadsheet fixed in 3.10.8

  6. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    phpoffice/phpspreadsheet fixed in 2.4.8

  7. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    phpoffice/phpspreadsheet fixed in 2.1.19

  8. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    phpoffice/phpspreadsheet fixed in 1.30.7

  9. Oct 27, 2026 · GitHub Advisory Database

    Updated

    ## Summary When PhpSpreadsheet loads an OpenDocument Spreadsheet ( ), reads the attribute of a with an unchecked cast, then materialises one cell per repeated row. This value is **completely unbounded**, so a **single ~1.4 KB file** can instruct the reader to create up to **millions of cells**, exhausting memory (fatal OOM). No authentication, no special configuration, and the default read filter

Sources

  • CVE.orgVulnerability recordCVE-2026-108359

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-108359

    30-day exploitation probability 0.66%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-j2w7-387v-m2rq

    PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-108359

    When PhpSpreadsheet loads an OpenDocument Spreadsheet (.ods), Ods::processTableRow() reads the table:number-rows-repeated attribute of a with an unchecked (int) cast, then materialises one cell per repeated row. This value is completely unbounded, so a single ~1.4 KB file can instruct the reader to create up to millions of cells, exhausting memory (fatal OOM). No authentication, no special configu

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-j2w7-387v-m2rq

    PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

    osv.dev

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 5, 2026
  • GitLab Advisory DatabaseOct 28, 2026
  • GitHub Advisory DatabaseOct 28, 2026
  • OpenSSF OSV / OSV ScannerOct 28, 2026
  • CVE.orgOct 27, 2026