CVE-2026-96222

EPPlus references versions of Microsoft's System.Security.Cryptography.Xml package affected by CVE-2026-96222. According to Microsoft, the vulnerability may allow spoofing through improper validation of certificate information contained in signed XML documents. The issue is related to the handling of KeyInfoX509Data, which can accept serialized certificate formats containing attacker-controlled chain metadata.

EPPlus includes support for Open XML digital signatures and uses functionality provided by the affected Microsoft package. However, EPPlus does not act as an identity provider, authentication service, or security token validation platform. Exploitation would require a specially crafted digital signature containing certificate information designed to abuse the affected certificate validation behavior. No direct attack vector affecting normal workbook creation, editing, or calculation has been identified. EPPlus assesses the practical impact of this vulnerability as Medium.

To address both this issue and the EPPlus security advisory GHSA-f4h2-2r6m-w59r, EPPlus has been updated to reference patched versions of the affected Microsoft dependency. Users are advised to upgrade to the latest patch release available for their EPPlus version line.

Patched EPPlus versions

• 7.0.11
• 7.1.4
• 7.2.3
• 7.3.3
• 7.4.3
• 7.5.4
• 7.6.2
• 7.7.4
• 8.0.9
• 8.1.2
• 8.2.2
• 8.3.2
• 8.4.3
• 8.5.5
• 8.6.4
• 8.7.2