Executive brief
LibreOffice, a popular open-source office productivity suite, is vulnerable to a memory corruption issue when processing certain types of embedded graphics. An attacker could create a malicious document that, when opened by a user, causes the application to crash or potentially allows for unauthorized code execution. This could lead to a loss of data or a compromise of the user's workstation.
Technical details
A heap buffer overflow exists in LibreOffice's EMF+ graphic import component. The vulnerability is caused by an integer overflow (CWE-190) when calculating the allocation size for gradient blend points. The application reads the number of blend points from a file and multiplies it to determine the buffer size; if this multiplication overflows, a small buffer is allocated. Subsequent data is then written into this undersized buffer, resulting in an out-of-bounds write (CWE-787). An attacker can exploit this by providing a specially crafted document containing a malicious EMF+ image. Fixed versions mitigate this by validating the blend-point count against the actual available data before performing the allocation.
Affected products
- The Document Foundation LibreOffice Versions prior to fix (specific fixed versions not listed in text for this CVE)
Timeline
- 2026-06-15: disclosed: CVE published to NVD dataset