# CVE-2026-8357: LibreOffice Calc heap buffer overflow in formula compilation

Source: https://junglewise.ai/threats/cve-2026-8357-libreoffice-calc-heap-buffer-overflow-in-formula-compilation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-8357 · Severity: info · CVSS 5.4 · Published 2026-06-15

LibreOffice Calc, a popular spreadsheet application, is vulnerable to a memory corruption issue when opening specially crafted files. An attacker could create a spreadsheet containing an extremely long and complex formula that causes the application to crash or potentially execute unauthorized code. This risk is triggered when a user simply opens the malicious document.

Vendors: [The Document Foundation](https://junglewise.ai/threats/vendors/the-document-foundation).

## Quick answers

**Is CVE-2026-8357 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8357 being exploited in the wild.

**How severe is CVE-2026-8357?** Informational severity, with a CVSS score of 5.4, published 15 June 2026.

**Which products and versions are affected?** The Document Foundation Calc Versions prior to fixed releases (e.g., 24.8.4, 25.2.1, 25.2.2, 25.2.4, 25.8.7, 26.2.3).

**Is there a fix for CVE-2026-8357?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8357 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-8357?** Check whether you run The Document Foundation Calc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer overflow exists in LibreOffice Calc's formula compilation engine. The vulnerability is caused by an off-by-one error (CWE-193) in the array used to track formula nesting depth. When a spreadsheet contains a formula with a very large number of opening tokens, the nesting depth exceeds the allocated size of the tracking array, leading to an out-of-bounds write (CWE-787). This is a local attack vector requiring user interaction (opening a file). Successful exploitation could lead to memory corruption, application instability, or potentially arbitrary code execution. The fix involves correctly sizing the array to accommodate the maximum possible nesting depth.

## Affected products

- The Document Foundation LibreOffice Calc Versions prior to fixed releases (e.g., 24.8.4, 25.2.1, 25.2.2, 25.2.4, 25.8.7, 26.2.3)

## Timeline

- 2026-06-15: disclosed
- 2026-06-15: advisory

## References

- [https://www.libreoffice.org/about-us/security/advisories/cve-2026-8357](https://www.libreoffice.org/about-us/security/advisories/cve-2026-8357)

## Related threats

- [LibreOffice Calc heap buffer overflow in tracked changes import](https://junglewise.ai/threats/cve-2026-8358-libreoffice-calc-heap-buffer-overflow-in-tracked-changes-import)