{"id":"CVE-2026-6040","aliases":["DEBIAN-CVE-2026-6040","EUVD-2026-36735","GHSA-pp4w-c8m6-4xvf","MGASA-2026-0259","SUSE-SU-2026:3140-1","UBUNTU-CVE-2026-6040","USN-8534-1","openSUSE-SU-2026:22216-1"],"status":"published","title":"Heap use-after-free in ODF number-format blank-width parsing","description":"A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00159,"percentile":0.0507,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416","CWE-787","CWE-825"],"published":"2026-06-15T16:21:53Z","modified":"2026-11-04T17:23:23Z","fixes":[{"ecosystem":"Debian:13","package":"libreoffice","fixed_in":["4:25.2.3-2+deb13u5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libreoffice","fixed_in":["4:26.2.3.2-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","fixed_in":["4:24.2.7-0ubuntu0.24.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","fixed_in":["4:26.2.4.2-0ubuntu0.26.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:25.2.3-2+deb13u5"}]}],"versions":["4:25.2.3-2","4:25.2.3-2+deb13u1","4:25.2.3-2+deb13u2","4:25.2.3-2+deb13u2~bpo12+1","4:25.2.3-2+deb13u3","4:25.2.3-2+deb13u3~bpo12+1","4:25.2.3-2+deb13u4","4:25.2.3-2+deb13u5~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.3.2-2"}]}],"versions":["4:25.2.3-2","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2~bpo13+1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.4.2-1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2.7.2-1.5.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.1-150500.20.37.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.1-150500.20.37.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.2.7-0ubuntu0.24.04.6"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:25.2.2-0ubuntu1","4:25.2.3-0ubuntu1","4:25.2.3-0ubuntu3","4:25.2.4~rc3-0ubuntu1","4:25.2.5~rc1-0ubuntu1","4:25.2.5-0ubuntu1","4:25.8.0~rc2-0ubuntu1","4:25.8.0~rc2-0ubuntu2","4:25.8.0~rc3-0ubuntu1","4:25.8.0~rc4-0ubuntu1","4:25.8.1~rc1-0ubuntu1","4:25.8.2-0ubuntu0.25.10.1","4:25.8.3-0ubuntu0.25.10.1","4:25.8.4-0ubuntu0.25.10.1","4:25.8.5-0ubuntu0.25.10.1","4:25.8.6-0ubuntu0.25.10.1","4:25.8.7-0ubuntu0.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.4.2-0ubuntu0.26.04.2"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3.7-0ubuntu0.22.04.12"}]}],"versions":["1:7.2.1-0ubuntu3","1:7.2.2-0ubuntu0.21.10.1","1:7.2.3~rc2-0ubuntu1","1:7.2.4-0ubuntu1","1:7.2.5~rc1-0ubuntu2","1:7.2.5~rc2-0ubuntu1","1:7.3.1~rc2-0ubuntu1","1:7.3.1~rc3-0ubuntu1","1:7.3.2~rc1-0ubuntu2","1:7.3.2~rc2-0ubuntu1","1:7.3.2-0ubuntu1","1:7.3.2-0ubuntu2","1:7.3.3-0ubuntu0.22.04.1","1:7.3.4-0ubuntu0.22.04.1","1:7.3.5-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.1","1:7.3.7-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.3","1:7.3.7-0ubuntu0.22.04.4","1:7.3.7-0ubuntu0.22.04.5","1:7.3.7-0ubuntu0.22.04.6","1:7.3.7-0ubuntu0.22.04.7","1:7.3.7-0ubuntu0.22.04.8","1:7.3.7-0ubuntu0.22.04.9","1:7.3.7-0ubuntu0.22.04.10","1:7.3.7-0ubuntu0.22.04.11"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.2.7-0ubuntu0.24.04.6"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.4.2-0ubuntu0.26.04.2"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.8.1.1-bp160.1.1"}]}],"bundled":8}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"the document foundation","product":"libreoffice"}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-6040","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6040","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488966","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6040.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6040"},{"url":"https://github.com/advisories/GHSA-pp4w-c8m6-4xvf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-6040","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0259.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35709","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00257.html","tags":["web"]},{"url":"https://www.libreoffice.org/security/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263140-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264357","tags":["report"]},{"url":"https://bugzilla.suse.com/1267735","tags":["report"]},{"url":"https://bugzilla.suse.com/1268494","tags":["report"]},{"url":"https://bugzilla.suse.com/1268497","tags":["report"]},{"url":"https://bugzilla.suse.com/1268504","tags":["report"]},{"url":"https://bugzilla.suse.com/1268522","tags":["report"]},{"url":"https://bugzilla.suse.com/1268527","tags":["report"]},{"url":"https://bugzilla.suse.com/1268528","tags":["report"]},{"url":"https://bugzilla.suse.com/1268529","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8358","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-6040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6040","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8534-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8358","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-6040","title":"Heap use-after-free in ODF number-format blank-width parsing","description":"A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.","status":"published","published":"2026-06-15T16:21:53.903Z","modified":"2026-07-23T12:08:09.144Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-416","CWE-787","CWE-825"],"updated_at":"2026-11-02T13:49:53.818886Z"}],"euvd":[{"id":"EUVD-2026-36735","description":"A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.","status":"published","published":"2026-06-15T16:21:53Z","modified":"2026-07-23T12:08:09Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T18:19:44.433437Z"}],"ghsa":[{"id":"GHSA-pp4w-c8m6-4xvf","title":"A heap use-after-free existed when importing the blank-width characters of an ODF number format....","description":"A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.","status":"published","published":"2026-06-15T18:31:19Z","modified":"2026-06-30T03:37:04Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416","CWE-825"],"updated_at":"2026-11-02T15:09:05.34707Z"}],"nvd":[{"id":"CVE-2026-6040","description":"A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.","status":"published","published":"2026-06-15T18:16:36.88Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416","CWE-787","CWE-825"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"DEBIAN-CVE-2026-6040","description":"A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.","status":"published","published":"2026-06-15T18:16:36.88Z","modified":"2026-10-26T11:47:33.149023344Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-6040","description":"A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.","status":"published","published":"2026-06-15T18:16:00Z","modified":"2026-07-14T02:01:52.208831304Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"MGASA-2026-0259","title":"Updated libreoffice packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nHeap buffer overflow in DXF polyline import. (CVE-2026-6039)\nHeap use-after-free in ODF number-format blank-width parsing.\n(CVE-2026-6040)\nHeap buffer overflow in EMF+ gradient brush import. (CVE-2026-6045)\nStack buffer overflow in PPT presentation import. (CVE-2026-8356)\nHeap buffer overflow in Calc formula compilation. (CVE-2026-8357)\nHeap buffer overflow in spreadsheet tracked-changes import.\n(CVE-2026-8358)\n","status":"published","published":"2026-07-18T05:48:16Z","modified":"2026-07-18T06:00:05.202862912Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:22216-1","title":"Security update for libreoffice","description":"This update for libreoffice fixes the following issues:\n\nChanges in libreoffice:\n\n- Upgrade to 26.8.1.1.\n\n- Perfect spec file sync between Factory, SLE and Leap 16.X.\n\n- Update to LibreOffice 26.2.5.1 (was 25.2.5.2).\n\n- Fix the following security issues:\n  * CVE-2026-6039 (bsc#1268494): Denial of Service via a specially\n    crafted DXF polyline import.\n  * CVE-2026-6045 (bsc#1268497): Heap buffer overflow via crafted\n    EMF+ graphics import.\n  * CVE-2026-6047 (bsc#1268504): Denial of Service via heap buffer\n    overflow in OOXML document processing.\n  * CVE-2026-8356 (bsc#1268522): Denial of Service via a specially\n    crafted PPT file.\n  * CVE-2026-6040 (bsc#1268527): Heap use-after-free when importing\n    the blank-width characters of an ODF number format.\n  * CVE-2026-8357 (bsc#1268528): Heap buffer overflow in Calc\n    formula compilation.\n  * CVE-2026-8358 (bsc#1268529): Heap buffer overflow in spreadsheet\n    tracked-changes import.\n  * CVE-2026-4430 (bsc#1264357): Out-of-bounds write via crafted\n    OOXML documents with mismatched encryption salt parameters.\n","status":"published","published":"2026-11-03T10:21:52Z","modified":"2026-11-04T17:23:23.836832996Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:3140-1","title":"Security update for libreoffice","description":"This update for libreoffice fixes the following issues:\n\nUpdate to LibreOffice 26.2.5.1.\n\nSecurity issues fixed:\n\n- CVE-2026-4430: out-of-bounds write via crafted OOXML documents with mismatched encryption salt parameters\n  (bsc#1264357).\n- CVE-2026-6039: denial of service via specially crafted DXF polyline import (bsc#1268494).\n- CVE-2026-6040: heap use-after-free when importing the blank-width characters of an ODF number format (bsc#1268527).\n- CVE-2026-6045: heap buffer overflow via crafted EMF+ graphics import (bsc#1268497).\n- CVE-2026-6047: denial of service via heap buffer overflow in OOXML document processing (bsc#1268504).\n- CVE-2026-8356: denial of service via a specially crafted PPT file (bsc#1268522).\n- CVE-2026-8357: heap buffer overflow in Calc formula compilation (bsc#1268528).\n- CVE-2026-8358: heap buffer overflow in spreadsheet tracked-changes import (bsc#1268529).\n- CVE-2026-50593: graphite2: out-of-bounds write via Graphite actions (bsc#1267735).\n\nOther updates and bugfixes:\n\n- Update to LibreOffice 26.2.5.1.\n  - Update bundled dependencies:\n    * `fontconfig` 2.17.1 -\u003e 2.18.0\n    * `graphite2-minimal` 1.3.14 -\u003e 1.3.15\n    * `libcmis` 0.6.2 -\u003e 0.6.3\n    * `libgpg-error` 1.59 -\u003e 1.61\n    * `lxml` 6.1.0 -\u003e 6.1.1\n    * `md4c` 0.5.2 -\u003e 0.5.3\n    * `poppler` 26.04.0 -\u003e 26.06.0\n    * `sqlite-amalgamation` 3530000 -\u003e 3530100\n    * `xmlsec1` 1.3.9 -\u003e 1.3.11\n- Update to LibreOffice 26.2.3.2 (PED-16098).\n  - Upgraded dependencies:\n    * `boost`: 1_88_0 -\u003e 1_89_0\n    * `freetype`: 2.14.1 -\u003e 2.14.3\n    * `harfbuzz`: 12.3.0 -\u003e 12.3.2\n    * `icu4c`: 77_1 -\u003e 78.3\n    * `libgpg-error`: 1.56 -\u003e 1.59\n    * `liborcus`: 0.20.1 -\u003e 0.21.0\n    * `pdfium`: 7012 -\u003e 7471\n    * `poppler`: 25.12.0 -\u003e 26.04.0\n    * `skia`: m136 -\u003e m142\n  - New bundled sources:\n    * `afdko` 4.0.3\n    * `antlr4-cpp-runtime` 4.13.2\n    * `fast_float` 8.2.2\n    * `libffi` 3.5.2\n    * `lxml` 6.1.0\n    * `md4c` 0.5.2\n    * `meson` 1.8.3\n    * `Python` 3.12.13\n    * `sqlite` 3530000\n    * `xmlsec1` 1.3.9\n    * `xz` 5.8.3\n- Add `patch`, required to build the bundled Python on all architectures.\n- Bundling a specific Python is now required as the one we ship (3.6) is too old to build `harfbuzz`.\n","status":"published","published":"2026-07-20T18:01:16Z","modified":"2026-07-21T09:45:06.737566804Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8534-1","title":"libreoffice vulnerabilities","description":"It was discovered that LibreOffice incorrectly handled importing DXF\ndrawings. An attacker could use this issue to cause LibreOffice to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2026-6039)\n\nIt was discovered that LibreOffice incorrectly handled certain ODF number\nformats. An attacker could use this issue to cause LibreOffice to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-6040)\n\nIt was discovered that LibreOffice incorrectly handled importing EMF+\ngraphics. An attacker could use this issue to cause LibreOffice to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2026-6045)\n\nIt was discovered that LibreOffice incorrectly handled importing PPT\npresentations. An attacker could use this issue to cause LibreOffice to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2026-8356)\n\nIt was discovered that LibreOffice Calc incorrectly handled compiling\ncertain formulas. An attacker could use this issue to cause LibreOffice to\ncrash, resulting in a denial of service, or possily execute arbitrary code.\n(CVE-2026-8357)\n\nIt was discovered that LibreOffice Calc incorrectly handled importing\nspreadsheet tracked changes. An attacker could use this issue to cause\nLibreOffice to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2026-8358)","status":"published","published":"2026-07-13T15:04:25Z","modified":"2026-07-14T02:11:33.191233485Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}