Executive brief
LibreOffice, a popular open-source office productivity suite, is vulnerable to a memory corruption issue when processing certain drawing files. An attacker could create a specially crafted DXF file (a format used by CAD software) that, when opened by a user, causes the application to crash or potentially allows for unauthorized code execution. This could lead to a loss of data or a disruption of business operations if malicious files are distributed to employees.
Technical details
A heap buffer overflow exists in LibreOffice's DXF (Drawing Exchange Format) import component. The vulnerability is caused by a numeric truncation error (CWE-197) where the point count for a polyline is truncated to a 16-bit value when allocating the point buffer, but the original, larger count is used when filling the buffer. This results in an out-of-bounds write (CWE-787) past the end of the heap-allocated memory. An attacker can exploit this by inducing a user to open a maliciously crafted DXF file. Successful exploitation can lead to a denial of service (application crash) or potentially arbitrary code execution in the context of the user. The issue is addressed in fixed versions by rejecting polylines with oversized point counts.
Affected products
- The Document Foundation LibreOffice
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory