Executive brief
LibreOffice is a popular open-source office productivity suite used for creating and editing documents. A security vulnerability was found in how it handles specific number formatting in OpenDocument Format (ODF) files. If a user opens a specially crafted document, it could cause the application to crash or potentially allow an attacker to execute unauthorized code, impacting the reliability and security of the user's system.
Technical details
A heap use-after-free vulnerability (CWE-416) and out-of-bounds write (CWE-787) exist in LibreOffice's ODF import component. The flaw is triggered when processing the blank-width characters of an ODF number format. A position value read from the document is not validated against the length of the format-code string, allowing the application to process memory outside the intended buffer. An attacker can exploit this by providing a malformed document that requires user interaction (opening the file). This can result in a crash (denial of service) or potentially arbitrary code execution in the context of the user. Fixed versions implement proper bounds-checking for the position value.
Affected products
- The Document Foundation LibreOffice
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory