CVE-2026-8357

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es):

• libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation (CVE-2026-8357)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es):

• libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation (CVE-2026-8357)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es):

• libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation (CVE-2026-8357)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es):

• libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation (CVE-2026-8357)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The updated packages fix security vulnerabilities: Heap buffer overflow in DXF polyline import. (CVE-2026-6039) Heap use-after-free in ODF number-format blank-width parsing. (CVE-2026-6040) Heap buffer overflow in EMF+ gradient brush import. (CVE-2026-6045) Stack buffer overflow in PPT presentation import. (CVE-2026-8356) Heap buffer overflow in Calc formula compilation. (CVE-2026-8357) Heap buffer overflow in spreadsheet tracked-changes import. (CVE-2026-8358)

This update for libreoffice fixes the following issues:

Changes in libreoffice:

• Upgrade to 26.8.1.1.

• Perfect spec file sync between Factory, SLE and Leap 16.X.

• Update to LibreOffice 26.2.5.1 (was 25.2.5.2).

• Fix the following security issues:

  • CVE-2026-6039 (bsc#1268494): Denial of Service via a specially crafted DXF polyline import.
  • CVE-2026-6045 (bsc#1268497): Heap buffer overflow via crafted EMF+ graphics import.
  • CVE-2026-6047 (bsc#1268504): Denial of Service via heap buffer overflow in OOXML document processing.
  • CVE-2026-8356 (bsc#1268522): Denial of Service via a specially crafted PPT file.
  • CVE-2026-6040 (bsc#1268527): Heap use-after-free when importing the blank-width characters of an ODF number format.
  • CVE-2026-8357 (bsc#1268528): Heap buffer overflow in Calc formula compilation.
  • CVE-2026-8358 (bsc#1268529): Heap buffer overflow in spreadsheet tracked-changes import.
  • CVE-2026-4430 (bsc#1264357): Out-of-bounds write via crafted OOXML documents with mismatched encryption salt parameters.

This update for libreoffice fixes the following issues:

Update to LibreOffice 26.2.5.1.

Security issues fixed:

• CVE-2026-4430: out-of-bounds write via crafted OOXML documents with mismatched encryption salt parameters (bsc#1264357).
• CVE-2026-6039: denial of service via specially crafted DXF polyline import (bsc#1268494).
• CVE-2026-6040: heap use-after-free when importing the blank-width characters of an ODF number format (bsc#1268527).
• CVE-2026-6045: heap buffer overflow via crafted EMF+ graphics import (bsc#1268497).
• CVE-2026-6047: denial of service via heap buffer overflow in OOXML document processing (bsc#1268504).
• CVE-2026-8356: denial of service via a specially crafted PPT file (bsc#1268522).
• CVE-2026-8357: heap buffer overflow in Calc formula compilation (bsc#1268528).
• CVE-2026-8358: heap buffer overflow in spreadsheet tracked-changes import (bsc#1268529).
• CVE-2026-50593: graphite2: out-of-bounds write via Graphite actions (bsc#1267735).

Other updates and bugfixes:

• Update to LibreOffice 26.2.5.1.
  • Update bundled dependencies:
    • fontconfig 2.17.1 -> 2.18.0
    • graphite2-minimal 1.3.14 -> 1.3.15
    • libcmis 0.6.2 -> 0.6.3
    • libgpg-error 1.59 -> 1.61
    • lxml 6.1.0 -> 6.1.1
    • md4c 0.5.2 -> 0.5.3
    • poppler 26.04.0 -> 26.06.0
    • sqlite-amalgamation 3530000 -> 3530100
    • xmlsec1 1.3.9 -> 1.3.11
• Update to LibreOffice 26.2.3.2 (PED-16098).
  • Upgraded dependencies:
    • boost: 1_88_0 -> 1_89_0
    • freetype: 2.14.1 -> 2.14.3
    • harfbuzz: 12.3.0 -> 12.3.2
    • icu4c: 77_1 -> 78.3
    • libgpg-error: 1.56 -> 1.59
    • liborcus: 0.20.1 -> 0.21.0
    • pdfium: 7012 -> 7471
    • poppler: 25.12.0 -> 26.04.0
    • skia: m136 -> m142
  • New bundled sources:
    • afdko 4.0.3
    • antlr4-cpp-runtime 4.13.2
    • fast_float 8.2.2
    • libffi 3.5.2
    • lxml 6.1.0
    • md4c 0.5.2
    • meson 1.8.3
    • Python 3.12.13
    • sqlite 3530000
    • xmlsec1 1.3.9
    • xz 5.8.3
• Add patch, required to build the bundled Python on all architectures.
• Bundling a specific Python is now required as the one we ship (3.6) is too old to build harfbuzz.

It was discovered that LibreOffice incorrectly handled importing DXF drawings. An attacker could use this issue to cause LibreOffice to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-6039)

It was discovered that LibreOffice incorrectly handled certain ODF number formats. An attacker could use this issue to cause LibreOffice to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-6040)

It was discovered that LibreOffice incorrectly handled importing EMF+ graphics. An attacker could use this issue to cause LibreOffice to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-6045)

It was discovered that LibreOffice incorrectly handled importing PPT presentations. An attacker could use this issue to cause LibreOffice to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-8356)

It was discovered that LibreOffice Calc incorrectly handled compiling certain formulas. An attacker could use this issue to cause LibreOffice to crash, resulting in a denial of service, or possily execute arbitrary code. (CVE-2026-8357)

It was discovered that LibreOffice Calc incorrectly handled importing spreadsheet tracked changes. An attacker could use this issue to cause LibreOffice to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-8358)