# CVE-2026-59933

## PhpSpreadsheet - XLS/OLE sector-chain loop causes memory exhaustion DoS

**Published:** Jul 25, 2026  
**CVSS Score:** High  
**7.5**

### Security Details

#### Components Impacted

**CVE ID:** CVE-2026-59933  
**CVE Description:** PhpSpreadsheet - XLS/OLE sector-chain loop causes memory exhaustion DoS  
**Published:** Jul 25, 2026  
**CVSS Score & Severity:** 7.5 High  
**CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H  
**EPSS Score:** 0%

**Malware:** malware

**KEV Status:** Not in KEV Catalog: No known exploits

**Affected Ecosystems:** affected

**Source:** National Vulnerability Database

### References

- [GitHub · PHPOffice/PhpSpreadsheet](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-xh5m-36r6-47m3)  
- [GitHub · Advisory · GHSA-xh5m-36r6-47m3](https://github.com/advisories/GHSA-xh5m-36r6-47m3)