CVE-2026-70162

EPPlus references versions of Microsoft's System.Security.Cryptography.Pkcs package affected by CVE-2026-70162. According to Microsoft, the vulnerability may allow a denial-of-service condition through inefficient processing of specially crafted CMS/PKCS#7 data via the EnvelopedCms.Decode() API. The issue may lead to excessive CPU consumption when processing attacker-controlled content.

EPPlus has reviewed its use of the affected package and has not identified any use of the vulnerable EnvelopedCms.Decode() API. While EPPlus includes support for digital signatures, no direct attack vector through normal workbook processing has been identified. Exploitation would require application-specific use of functionality outside the APIs used by EPPlus. EPPlus therefore assesses the practical impact of this vulnerability as Low.

To address both this issue and the EPPlus security advisory GHSA-f4h2-2r6m-w59r, EPPlus has been updated to reference patched versions of the affected Microsoft dependency. Users are advised to upgrade to the latest patch release available for their EPPlus version line.

Patched EPPlus versions

• 7.0.11
• 7.1.4
• 7.2.3
• 7.3.3
• 7.4.3
• 7.5.4
• 7.6.2
• 7.7.4
• 8.0.9
• 8.1.2
• 8.2.2
• 8.3.2
• 8.4.3
• 8.5.5
• 8.6.4
• 8.7.2