CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-40902

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequent row iteration to attempt ~1 billion loop cycles and exhaust CPU resources. This vulnerability is fixed in 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 17.5%

CVSS Severity

CVSS v3 Score 7.5

References

Products affected by CVE-2026-40902

Phpoffice » Phpspreadsheet » Version: N/A

cpe:2.3:a:phpoffice:phpspreadsheet:-
Phpoffice » Phpspreadsheet » Version: 1.0.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.0.0
Phpoffice » Phpspreadsheet » Version: 1.1.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.1.0
Phpoffice » Phpspreadsheet » Version: 1.10.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.10.0
Phpoffice » Phpspreadsheet » Version: 1.10.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.10.1
Phpoffice » Phpspreadsheet » Version: 1.11.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.11.0
Phpoffice » Phpspreadsheet » Version: 1.12.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.12.0
Phpoffice » Phpspreadsheet » Version: 1.13.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.13.0
Phpoffice » Phpspreadsheet » Version: 1.14.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.14.0
Phpoffice » Phpspreadsheet » Version: 1.14.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.14.1
Phpoffice » Phpspreadsheet » Version: 1.15.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.15.0
Phpoffice » Phpspreadsheet » Version: 1.16.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.16.0
Phpoffice » Phpspreadsheet » Version: 1.17.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.17.0
Phpoffice » Phpspreadsheet » Version: 1.17.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.17.1
Phpoffice » Phpspreadsheet » Version: 1.18.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.18.0
Phpoffice » Phpspreadsheet » Version: 1.19.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.19.0
Phpoffice » Phpspreadsheet » Version: 1.2.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.2.0
Phpoffice » Phpspreadsheet » Version: 1.2.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.2.1
Phpoffice » Phpspreadsheet » Version: 1.20.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.20.0
Phpoffice » Phpspreadsheet » Version: 1.21.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.21.0
Phpoffice » Phpspreadsheet » Version: 1.22.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.22.0
Phpoffice » Phpspreadsheet » Version: 1.23.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.23.0
Phpoffice » Phpspreadsheet » Version: 1.24.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.24.0
Phpoffice » Phpspreadsheet » Version: 1.24.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.24.1
Phpoffice » Phpspreadsheet » Version: 1.25.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.25.0
Phpoffice » Phpspreadsheet » Version: 1.25.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.25.1
Phpoffice » Phpspreadsheet » Version: 1.25.2

cpe:2.3:a:phpoffice:phpspreadsheet:1.25.2
Phpoffice » Phpspreadsheet » Version: 1.26.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.26.0
Phpoffice » Phpspreadsheet » Version: 1.27.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.27.0
Phpoffice » Phpspreadsheet » Version: 1.27.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.27.1
Phpoffice » Phpspreadsheet » Version: 1.28.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.28.0
Phpoffice » Phpspreadsheet » Version: 1.29.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.0
Phpoffice » Phpspreadsheet » Version: 1.29.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.1
Phpoffice » Phpspreadsheet » Version: 1.29.10

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.10
Phpoffice » Phpspreadsheet » Version: 1.29.11

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.11
Phpoffice » Phpspreadsheet » Version: 1.29.12

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.12
Phpoffice » Phpspreadsheet » Version: 1.29.2

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.2
Phpoffice » Phpspreadsheet » Version: 1.29.4

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.4
Phpoffice » Phpspreadsheet » Version: 1.29.5

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.5
Phpoffice » Phpspreadsheet » Version: 1.29.6

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.6
Phpoffice » Phpspreadsheet » Version: 1.29.7

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.7
Phpoffice » Phpspreadsheet » Version: 1.29.8

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.8
Phpoffice » Phpspreadsheet » Version: 1.29.9

cpe:2.3:a:phpoffice:phpspreadsheet:1.29.9
Phpoffice » Phpspreadsheet » Version: 1.3.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.3.0
Phpoffice » Phpspreadsheet » Version: 1.3.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.3.1
Phpoffice » Phpspreadsheet » Version: 1.30.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.30.0
Phpoffice » Phpspreadsheet » Version: 1.30.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.30.1
Phpoffice » Phpspreadsheet » Version: 1.30.2

cpe:2.3:a:phpoffice:phpspreadsheet:1.30.2
Phpoffice » Phpspreadsheet » Version: 1.30.3

cpe:2.3:a:phpoffice:phpspreadsheet:1.30.3
Phpoffice » Phpspreadsheet » Version: 1.4.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.4.0
Phpoffice » Phpspreadsheet » Version: 1.4.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.4.1
Phpoffice » Phpspreadsheet » Version: 1.5.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.5.0
Phpoffice » Phpspreadsheet » Version: 1.5.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.5.1
Phpoffice » Phpspreadsheet » Version: 1.5.2

cpe:2.3:a:phpoffice:phpspreadsheet:1.5.2
Phpoffice » Phpspreadsheet » Version: 1.6.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.6.0
Phpoffice » Phpspreadsheet » Version: 1.7.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.7.0
Phpoffice » Phpspreadsheet » Version: 1.8.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.8.0
Phpoffice » Phpspreadsheet » Version: 1.8.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.8.1
Phpoffice » Phpspreadsheet » Version: 1.8.2

cpe:2.3:a:phpoffice:phpspreadsheet:1.8.2
Phpoffice » Phpspreadsheet » Version: 1.9.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.9.0
Phpoffice » Phpspreadsheet » Version: 2.0.0

cpe:2.3:a:phpoffice:phpspreadsheet:2.0.0
Phpoffice » Phpspreadsheet » Version: 2.1.0

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.0
Phpoffice » Phpspreadsheet » Version: 2.1.1

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.1
Phpoffice » Phpspreadsheet » Version: 2.1.10

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.10
Phpoffice » Phpspreadsheet » Version: 2.1.11

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.11
Phpoffice » Phpspreadsheet » Version: 2.1.12

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.12
Phpoffice » Phpspreadsheet » Version: 2.1.13

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.13
Phpoffice » Phpspreadsheet » Version: 2.1.14

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.14
Phpoffice » Phpspreadsheet » Version: 2.1.15

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.15
Phpoffice » Phpspreadsheet » Version: 2.1.3

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.3
Phpoffice » Phpspreadsheet » Version: 2.1.4

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.4
Phpoffice » Phpspreadsheet » Version: 2.1.5

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.5
Phpoffice » Phpspreadsheet » Version: 2.1.6

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.6
Phpoffice » Phpspreadsheet » Version: 2.1.7

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.7
Phpoffice » Phpspreadsheet » Version: 2.1.8

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.8
Phpoffice » Phpspreadsheet » Version: 2.1.9

cpe:2.3:a:phpoffice:phpspreadsheet:2.1.9
Phpoffice » Phpspreadsheet » Version: 2.2.0

cpe:2.3:a:phpoffice:phpspreadsheet:2.2.0
Phpoffice » Phpspreadsheet » Version: 2.2.1

cpe:2.3:a:phpoffice:phpspreadsheet:2.2.1
Phpoffice » Phpspreadsheet » Version: 2.2.2

cpe:2.3:a:phpoffice:phpspreadsheet:2.2.2
Phpoffice » Phpspreadsheet » Version: 2.3.0

cpe:2.3:a:phpoffice:phpspreadsheet:2.3.0
Phpoffice » Phpspreadsheet » Version: 2.3.10

cpe:2.3:a:phpoffice:phpspreadsheet:2.3.10
Phpoffice » Phpspreadsheet » Version: 2.3.2

cpe:2.3:a:phpoffice:phpspreadsheet:2.3.2
Phpoffice » Phpspreadsheet » Version: 2.3.3

cpe:2.3:a:phpoffice:phpspreadsheet:2.3.3
Phpoffice » Phpspreadsheet » Version: 2.3.4

cpe:2.3:a:phpoffice:phpspreadsheet:2.3.4
Phpoffice » Phpspreadsheet » Version: 2.3.5

cpe:2.3:a:phpoffice:phpspreadsheet:2.3.5
Phpoffice » Phpspreadsheet » Version: 2.3.6

cpe:2.3:a:phpoffice:phpspreadsheet:2.3.6
Phpoffice » Phpspreadsheet » Version: 2.3.7

cpe:2.3:a:phpoffice:phpspreadsheet:2.3.7
Phpoffice » Phpspreadsheet » Version: 2.3.8

cpe:2.3:a:phpoffice:phpspreadsheet:2.3.8
Phpoffice » Phpspreadsheet » Version: 2.3.9

cpe:2.3:a:phpoffice:phpspreadsheet:2.3.9
Phpoffice » Phpspreadsheet » Version: 2.4.0

cpe:2.3:a:phpoffice:phpspreadsheet:2.4.0
Phpoffice » Phpspreadsheet » Version: 2.4.1

cpe:2.3:a:phpoffice:phpspreadsheet:2.4.1
Phpoffice » Phpspreadsheet » Version: 2.4.2

cpe:2.3:a:phpoffice:phpspreadsheet:2.4.2
Phpoffice » Phpspreadsheet » Version: 2.4.3

cpe:2.3:a:phpoffice:phpspreadsheet:2.4.3
Phpoffice » Phpspreadsheet » Version: 2.4.4

cpe:2.3:a:phpoffice:phpspreadsheet:2.4.4
Phpoffice » Phpspreadsheet » Version: 3.10.0

cpe:2.3:a:phpoffice:phpspreadsheet:3.10.0
Phpoffice » Phpspreadsheet » Version: 3.10.1

cpe:2.3:a:phpoffice:phpspreadsheet:3.10.1
Phpoffice » Phpspreadsheet » Version: 3.10.2

cpe:2.3:a:phpoffice:phpspreadsheet:3.10.2
Phpoffice » Phpspreadsheet » Version: 3.10.3

cpe:2.3:a:phpoffice:phpspreadsheet:3.10.3
Phpoffice » Phpspreadsheet » Version: 3.10.4

cpe:2.3:a:phpoffice:phpspreadsheet:3.10.4
Phpoffice » Phpspreadsheet » Version: 3.3.0

cpe:2.3:a:phpoffice:phpspreadsheet:3.3.0
Phpoffice » Phpspreadsheet » Version: 3.4.0

cpe:2.3:a:phpoffice:phpspreadsheet:3.4.0
Phpoffice » Phpspreadsheet » Version: 3.5.0

cpe:2.3:a:phpoffice:phpspreadsheet:3.5.0
Phpoffice » Phpspreadsheet » Version: 3.6.0

cpe:2.3:a:phpoffice:phpspreadsheet:3.6.0
Phpoffice » Phpspreadsheet » Version: 3.7.0

cpe:2.3:a:phpoffice:phpspreadsheet:3.7.0
Phpoffice » Phpspreadsheet » Version: 3.8.0

cpe:2.3:a:phpoffice:phpspreadsheet:3.8.0
Phpoffice » Phpspreadsheet » Version: 3.9.0

cpe:2.3:a:phpoffice:phpspreadsheet:3.9.0
Phpoffice » Phpspreadsheet » Version: 3.9.1

cpe:2.3:a:phpoffice:phpspreadsheet:3.9.1
Phpoffice » Phpspreadsheet » Version: 3.9.2

cpe:2.3:a:phpoffice:phpspreadsheet:3.9.2
Phpoffice » Phpspreadsheet » Version: 3.9.3

cpe:2.3:a:phpoffice:phpspreadsheet:3.9.3
Phpoffice » Phpspreadsheet » Version: 4.0.0

cpe:2.3:a:phpoffice:phpspreadsheet:4.0.0
Phpoffice » Phpspreadsheet » Version: 4.1.0

cpe:2.3:a:phpoffice:phpspreadsheet:4.1.0
Phpoffice » Phpspreadsheet » Version: 4.2.0

cpe:2.3:a:phpoffice:phpspreadsheet:4.2.0
Phpoffice » Phpspreadsheet » Version: 4.3.0

cpe:2.3:a:phpoffice:phpspreadsheet:4.3.0
Phpoffice » Phpspreadsheet » Version: 4.3.1

cpe:2.3:a:phpoffice:phpspreadsheet:4.3.1
Phpoffice » Phpspreadsheet » Version: 4.4.0

cpe:2.3:a:phpoffice:phpspreadsheet:4.4.0
Phpoffice » Phpspreadsheet » Version: 4.5.0

cpe:2.3:a:phpoffice:phpspreadsheet:4.5.0
Phpoffice » Phpspreadsheet » Version: 5.0.0

cpe:2.3:a:phpoffice:phpspreadsheet:5.0.0
Phpoffice » Phpspreadsheet » Version: 5.1.0

cpe:2.3:a:phpoffice:phpspreadsheet:5.1.0
Phpoffice » Phpspreadsheet » Version: 5.2.0

cpe:2.3:a:phpoffice:phpspreadsheet:5.2.0
Phpoffice » Phpspreadsheet » Version: 5.3.0

cpe:2.3:a:phpoffice:phpspreadsheet:5.3.0
Phpoffice » Phpspreadsheet » Version: 5.4.0

cpe:2.3:a:phpoffice:phpspreadsheet:5.4.0
Phpoffice » Phpspreadsheet » Version: 5.5.0

cpe:2.3:a:phpoffice:phpspreadsheet:5.5.0
Phpoffice » Phpspreadsheet » Version: 5.6.0

cpe:2.3:a:phpoffice:phpspreadsheet:5.6.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-40902

Products

Pricing

Contact Us