CVE-2026-108359
Received
Received - Intake
Memory Exhaustion in PhpSpreadsheet ODS Reader
Vulnerability report for CVE-2026-108359, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-22
Last updated on: 2026-10-22
Assigner: GitHub, Inc.
Description
Description
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a value, the reader materializes a cell for every repetition without checking the spreadsheet row limit, so a small attacker-controlled ODS file can consume substantial CPU and memory and terminate the PHP worker. Column repetition is separately bounded and is not part of this vulnerability. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| PHPOffice | PhpSpreadsheet | < 1.30.7 |
| PHPOffice | PhpSpreadsheet | >= 2.0.0, < 2.1.19 |
| PHPOffice | PhpSpreadsheet | >= 2.2.0, < 2.4.8 |
| PHPOffice | PhpSpreadsheet | >= 3.3.0, < 3.10.8 |
| PHPOffice | PhpSpreadsheet | >= 4.0.0, < 5.10.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
| CWE-789 | The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. |
