CVE-2026-96960

EPPlus references versions of Microsoft's System.Security.Cryptography.Xml package affected by CVE-2026-96960. According to Microsoft, the vulnerability may allow a denial-of-service condition when processing specially crafted signed XML data. The issue is related to resource consumption during XML signature verification and processing, including handling of deeply nested XML structures, entity references, canonicalization transforms, and encrypted XML elements.

EPPlus includes support for Open XML digital signatures and therefore uses functionality provided by the affected Microsoft package. Exploitation would require an attacker to supply a specially crafted workbook containing digital signature content designed to trigger excessive resource consumption during signature processing. Normal workbook loading, calculation, and generation scenarios are not affected. EPPlus therefore assesses the practical impact of this vulnerability as Low.

To address both this issue and the EPPlus security advisory GHSA-f4h2-2r6m-w59r, EPPlus has been updated to reference patched versions of the affected Microsoft dependency. Users are advised to upgrade to the latest patch release available for their EPPlus version line.

?Patched EPPlus versions

• 7.0.11
• 7.1.4
• 7.2.3
• 7.3.3
• 7.4.3
• 7.5.4
• 7.6.2
• 7.7.4
• 8.0.9
• 8.1.2
• 8.2.2
• 8.3.2
• 8.4.3
• 8.5.5
• 8.6.4
• 8.7.2