Executive brief
LibreOffice Calc, a popular spreadsheet application, is vulnerable to a memory corruption issue when opening specially crafted files. An attacker could create a spreadsheet that reuses internal identifiers for tracked changes, causing the software to crash or potentially execute unauthorized code. This requires a user to manually open a malicious document provided by an attacker.
Technical details
A heap buffer overflow exists in LibreOffice Calc's tracked changes import mechanism. The vulnerability is caused by type confusion when a document reuses the same change identifier for two different types of changes. The importer incorrectly treats a change object as a larger type than originally allocated, leading to an out-of-bounds write (CWE-787) on the heap. Exploitation requires a user to open a maliciously crafted spreadsheet. In fixed versions, the importer has been updated to reject records with duplicate identifiers.
Affected products
- The Document Foundation LibreOffice Calc Versions prior to the fix (specific version numbers not provided in text for this CVE)
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory