A denial-of-service vulnerability exists in PhpSpreadsheet, a pure PHP library for reading and writing spreadsheet files. The OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself, causing OLERead::read() to append the same sector data repeatedly until the PHP process exhausts memory. This vulnerability is reachable from Reader\Xls::canRead() and automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads are at risk of denial of service from a very small file. Affected versions span multiple release branches including 1.x through 5.x. Fixes have been released in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.