Is CVE-2026-8358 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8358 being exploited in the wild.

How severe is CVE-2026-8358?

Informational severity, with a CVSS score of 5.4, published 15 June 2026.

Which products and versions are affected?

The Document Foundation Calc Versions prior to the fix (specific version numbers not provided in text for this CVE).

Is there a fix for CVE-2026-8358?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8358 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-8358?

Check whether you run The Document Foundation Calc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8358: LibreOffice Calc heap buffer overflow in tracked changes import

CVE-2026-8358 · Severity: info · CVSS 5.4 · Published 2026-06-15

LibreOffice Calc, a popular spreadsheet application, is vulnerable to a memory corruption issue when opening specially crafted files. An attacker could create a spreadsheet that reuses internal identifiers for tracked changes, causing the software to crash or potentially execute unauthorized code. This requires a user to manually open a malicious document provided by an attacker.

Vendors: The Document Foundation.

Quick answers

Is CVE-2026-8358 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8358 being exploited in the wild.
How severe is CVE-2026-8358?: Informational severity, with a CVSS score of 5.4, published 15 June 2026.
Which products and versions are affected?: The Document Foundation Calc Versions prior to the fix (specific version numbers not provided in text for this CVE).
Is there a fix for CVE-2026-8358?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8358 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-8358?: Check whether you run The Document Foundation Calc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap buffer overflow exists in LibreOffice Calc's tracked changes import mechanism. The vulnerability is caused by type confusion when a document reuses the same change identifier for two different types of changes. The importer incorrectly treats a change object as a larger type than originally allocated, leading to an out-of-bounds write (CWE-787) on the heap. Exploitation requires a user to open a maliciously crafted spreadsheet. In fixed versions, the importer has been updated to reject records with duplicate identifiers.

Affected products

The Document Foundation LibreOffice Calc Versions prior to the fix (specific version numbers not provided in text for this CVE)

Timeline

2026-06-15: disclosed
2026-06-15: advisory

References

https://www.libreoffice.org/about-us/security/advisories/cve-2026-8358

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.