CVE-2026-96958

EPPlus references versions of Microsoft's System.Security.Cryptography.Xml package affected by CVE-2026-96958. According to Microsoft, the vulnerability may allow a denial-of-service condition when processing specially crafted signed XML data. The issue is related to inefficient algorithmic complexity in XML signature processing, potentially leading to excessive CPU and memory consumption.

EPPlus includes support for Open XML digital signatures and therefore uses functionality provided by the affected Microsoft package. Exploitation would require an attacker to supply a specially crafted workbook containing malicious digital signature content designed to trigger excessive resource consumption during signature processing or validation. The vulnerability does not affect normal workbook creation, calculation, or editing scenarios. EPPlus therefore assesses the practical impact of this vulnerability as Low.

To address both this issue and the EPPlus security advisory GHSA-f4h2-2r6m-w59r, EPPlus has been updated to reference patched versions of the affected Microsoft dependency. Users are advised to upgrade to the latest patch release available for their EPPlus version line.

?Patched EPPlus versions

• 7.0.11
• 7.1.4
• 7.2.3
• 7.3.3
• 7.4.3
• 7.5.4
• 7.6.2
• 7.7.4
• 8.0.9
• 8.1.2
• 8.2.2
• 8.3.2
• 8.4.3
• 8.5.5
• 8.6.4
• 8.7.2