Executive brief
LibreOffice Calc, a popular spreadsheet application, is vulnerable to a memory corruption issue when opening specially crafted files. An attacker could create a spreadsheet containing an extremely long and complex formula that causes the application to crash or potentially execute unauthorized code. This risk is triggered when a user simply opens the malicious document.
Technical details
A heap buffer overflow exists in LibreOffice Calc's formula compilation engine. The vulnerability is caused by an off-by-one error (CWE-193) in the array used to track formula nesting depth. When a spreadsheet contains a formula with a very large number of opening tokens, the nesting depth exceeds the allocated size of the tracking array, leading to an out-of-bounds write (CWE-787). This is a local attack vector requiring user interaction (opening a file). Successful exploitation could lead to memory corruption, application instability, or potentially arbitrary code execution. The fix involves correctly sizing the array to accommodate the maximum possible nesting depth.
Affected products
- The Document Foundation LibreOffice Calc Versions prior to fixed releases (e.g., 24.8.4, 25.2.1, 25.2.2, 25.2.4, 25.8.7, 26.2.3)
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory