Executive brief
LibreOffice, a popular open-source office productivity suite, is vulnerable to a memory corruption issue when processing older PowerPoint (.ppt) files. An attacker could create a specially crafted presentation that, when opened by a user, causes the application to crash or potentially allows for unauthorized actions on the user's computer. This flaw impacts the reliability of the software and could be used as a foothold for further system compromise if a user is tricked into opening a malicious file.
Technical details
A stack-based buffer overflow (CWE-121) exists in LibreOffice's legacy PPT import filter. The vulnerability is rooted in the processing of colour-replacement records, where two fixed-size colour tables are populated from the file. Because the write position was not reset between two passes over the record, a crafted file with combined colour counts exceeding the table size results in an out-of-bounds write (CWE-787) on the stack. An attacker can exploit this by providing a malicious PPT file; successful exploitation requires user interaction (opening the file) and can lead to arbitrary code execution or a denial-of-service (crash). The issue is resolved in versions 26.2.3 and 25.8.7 by ensuring the unused second pass is no longer read into the tables.
Affected products
- The Document Foundation LibreOffice Versions prior to 26.2.3 and 25.8.7
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory