Junglewise Threat Intelligence

CVE-2026-6040: The Document Foundation LibreOffice use-after-free in ODF import

CVE-2026-6040 · Severity: info · CVSS 5.4 · Published 2026-06-15

Technologies: The Document Foundation LibreOffice. Vendors: The Document Foundation.

Executive brief

LibreOffice is a popular open-source office productivity suite used for creating and editing documents. A security vulnerability was found in how it handles specific number formatting in OpenDocument Format (ODF) files. If a user opens a specially crafted document, it could cause the application to crash or potentially allow an attacker to execute unauthorized code, impacting the reliability and security of the user's system.

Technical details

A heap use-after-free vulnerability (CWE-416) and out-of-bounds write (CWE-787) exist in LibreOffice's ODF import component. The flaw is triggered when processing the blank-width characters of an ODF number format. A position value read from the document is not validated against the length of the format-code string, allowing the application to process memory outside the intended buffer. An attacker can exploit this by providing a malformed document that requires user interaction (opening the file). This can result in a crash (denial of service) or potentially arbitrary code execution in the context of the user. Fixed versions implement proper bounds-checking for the position value.

Affected products

  • The Document Foundation LibreOffice

Timeline

  • 2026-06-15: disclosed
  • 2026-06-15: advisory

References

Related threats