CVE-2026-96959

EPPlus references versions of Microsoft's System.Security.Cryptography.Xml package affected by CVE-2026-96959. According to Microsoft, the vulnerability may allow a denial-of-service condition when processing specially crafted XML signature or XML encryption content. The issue is related to insufficient limits on resource consumption during cryptographic XML processing.

EPPlus includes support for Open XML digital signatures and therefore uses functionality provided by the affected Microsoft package. Exploitation would require an attacker to supply a specially crafted workbook containing malicious digital signature content intended to trigger excessive resource consumption during signature validation. The vulnerability does not affect normal workbook creation, calculation, or editing scenarios. EPPlus therefore assesses the practical impact of this vulnerability as Low.

To address both this issue and the EPPlus security advisory GHSA-f4h2-2r6m-w59r, EPPlus has been updated to reference patched versions of the affected Microsoft dependency. Users are advised to upgrade to the latest patch release available for their EPPlus version line.

Patched EPPlus versions

• 7.0.11
• 7.1.4
• 7.2.3
• 7.3.3
• 7.4.3
• 7.5.4
• 7.6.2
• 7.7.4
• 8.0.9
• 8.1.2
• 8.2.2
• 8.3.2
• 8.4.3
• 8.5.5
• 8.6.4
• 8.7.2