CVE-2026-84008

EPPlus references versions of Microsoft's System.Security.Cryptography.Pkcs package affected by CVE-2026-84008. According to Microsoft, the vulnerability may allow a denial-of-service condition through inefficient processing of specially crafted CMS/PKCS#7 signature data during signature validation. The issue affects the SignedCms.CheckSignature() API in the Microsoft package.

EPPlus does not use the affected API when reading, writing, calculating, or otherwise processing Excel workbooks. No direct attack vector through normal EPPlus functionality has been identified. Exploitation would require an application using EPPlus to separately process attacker-controlled CMS or PKCS#7 signed content through the vulnerable Microsoft API. EPPlus therefore assesses the practical impact of this vulnerability as Low.

To address both this issue and the EPPlus security advisory GHSA-f4h2-2r6m-w59r, EPPlus has been updated to reference patched versions of the affected Microsoft dependency. Users are advised to upgrade to the latest patch release available for their EPPlus version line.

Patched EPPlus versions

• 7.0.11
• 7.1.4
• 7.2.3
• 7.3.3
• 7.4.3
• 7.5.4
• 7.6.2
• 7.7.4
• 8.0.9
• 8.1.2
• 8.2.2
• 8.3.2
• 8.4.3
• 8.5.5
• 8.6.4
• 8.7.2