{"id":"CVE-2026-6047","aliases":["DEBIAN-CVE-2026-6047","EUVD-2026-36737","GHSA-wq72-h3fh-w757","SUSE-SU-2026:3140-1","UBUNTU-CVE-2026-6047","openSUSE-SU-2026:22216-1"],"status":"published","title":"Heap buffer overflow in OOXML text box element import","description":"LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00154,"percentile":0.04577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787","CWE-843"],"published":"2026-06-15T16:22:37Z","modified":"2026-11-04T17:23:23Z","fixes":[{"ecosystem":"Debian:14","package":"libreoffice","fixed_in":["4:26.2.3.2-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","fixed_in":["4:26.2.4.2-0ubuntu0.26.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.3.2-2"}]}],"versions":["4:25.2.3-2","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2~bpo13+1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.1-150500.20.37.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.1-150500.20.37.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.4.2-0ubuntu0.26.04.2"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.8.1.1-bp160.1.1"}]}],"bundled":8}],"products":[{"vendor":"the document foundation","product":"libreoffice"}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-6047","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6047"},{"url":"https://github.com/advisories/GHSA-wq72-h3fh-w757"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-6047","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263140-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264357","tags":["report"]},{"url":"https://bugzilla.suse.com/1267735","tags":["report"]},{"url":"https://bugzilla.suse.com/1268494","tags":["report"]},{"url":"https://bugzilla.suse.com/1268497","tags":["report"]},{"url":"https://bugzilla.suse.com/1268504","tags":["report"]},{"url":"https://bugzilla.suse.com/1268522","tags":["report"]},{"url":"https://bugzilla.suse.com/1268527","tags":["report"]},{"url":"https://bugzilla.suse.com/1268528","tags":["report"]},{"url":"https://bugzilla.suse.com/1268529","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8358","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-6047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6047","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-6047","title":"Heap buffer overflow in OOXML text box element import","description":"LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.","status":"published","published":"2026-06-15T16:22:37.208Z","modified":"2026-06-15T18:11:48.806Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-787","CWE-843"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-36737","description":"LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.","status":"published","published":"2026-06-15T16:22:37Z","modified":"2026-06-15T18:11:48Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T18:20:41.888684Z"}],"ghsa":[{"id":"GHSA-wq72-h3fh-w757","title":"LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when...","description":"LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.","status":"published","published":"2026-06-15T18:31:19Z","modified":"2026-06-15T18:31:25Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:08:46.336077Z"}],"nvd":[{"id":"CVE-2026-6047","description":"LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.","status":"published","published":"2026-06-15T18:16:37.127Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-787","CWE-843"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"DEBIAN-CVE-2026-6047","description":"LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.","status":"published","published":"2026-06-15T18:16:37.127Z","modified":"2026-10-26T11:47:37.352703905Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-6047","description":"LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.","status":"published","published":"2026-06-15T18:16:00Z","modified":"2026-07-14T02:01:43.278144274Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"openSUSE-SU-2026:22216-1","title":"Security update for libreoffice","description":"This update for libreoffice fixes the following issues:\n\nChanges in libreoffice:\n\n- Upgrade to 26.8.1.1.\n\n- Perfect spec file sync between Factory, SLE and Leap 16.X.\n\n- Update to LibreOffice 26.2.5.1 (was 25.2.5.2).\n\n- Fix the following security issues:\n  * CVE-2026-6039 (bsc#1268494): Denial of Service via a specially\n    crafted DXF polyline import.\n  * CVE-2026-6045 (bsc#1268497): Heap buffer overflow via crafted\n    EMF+ graphics import.\n  * CVE-2026-6047 (bsc#1268504): Denial of Service via heap buffer\n    overflow in OOXML document processing.\n  * CVE-2026-8356 (bsc#1268522): Denial of Service via a specially\n    crafted PPT file.\n  * CVE-2026-6040 (bsc#1268527): Heap use-after-free when importing\n    the blank-width characters of an ODF number format.\n  * CVE-2026-8357 (bsc#1268528): Heap buffer overflow in Calc\n    formula compilation.\n  * CVE-2026-8358 (bsc#1268529): Heap buffer overflow in spreadsheet\n    tracked-changes import.\n  * CVE-2026-4430 (bsc#1264357): Out-of-bounds write via crafted\n    OOXML documents with mismatched encryption salt parameters.\n","status":"published","published":"2026-11-03T10:21:52Z","modified":"2026-11-04T17:23:23.836832996Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:3140-1","title":"Security update for libreoffice","description":"This update for libreoffice fixes the following issues:\n\nUpdate to LibreOffice 26.2.5.1.\n\nSecurity issues fixed:\n\n- CVE-2026-4430: out-of-bounds write via crafted OOXML documents with mismatched encryption salt parameters\n  (bsc#1264357).\n- CVE-2026-6039: denial of service via specially crafted DXF polyline import (bsc#1268494).\n- CVE-2026-6040: heap use-after-free when importing the blank-width characters of an ODF number format (bsc#1268527).\n- CVE-2026-6045: heap buffer overflow via crafted EMF+ graphics import (bsc#1268497).\n- CVE-2026-6047: denial of service via heap buffer overflow in OOXML document processing (bsc#1268504).\n- CVE-2026-8356: denial of service via a specially crafted PPT file (bsc#1268522).\n- CVE-2026-8357: heap buffer overflow in Calc formula compilation (bsc#1268528).\n- CVE-2026-8358: heap buffer overflow in spreadsheet tracked-changes import (bsc#1268529).\n- CVE-2026-50593: graphite2: out-of-bounds write via Graphite actions (bsc#1267735).\n\nOther updates and bugfixes:\n\n- Update to LibreOffice 26.2.5.1.\n  - Update bundled dependencies:\n    * `fontconfig` 2.17.1 -\u003e 2.18.0\n    * `graphite2-minimal` 1.3.14 -\u003e 1.3.15\n    * `libcmis` 0.6.2 -\u003e 0.6.3\n    * `libgpg-error` 1.59 -\u003e 1.61\n    * `lxml` 6.1.0 -\u003e 6.1.1\n    * `md4c` 0.5.2 -\u003e 0.5.3\n    * `poppler` 26.04.0 -\u003e 26.06.0\n    * `sqlite-amalgamation` 3530000 -\u003e 3530100\n    * `xmlsec1` 1.3.9 -\u003e 1.3.11\n- Update to LibreOffice 26.2.3.2 (PED-16098).\n  - Upgraded dependencies:\n    * `boost`: 1_88_0 -\u003e 1_89_0\n    * `freetype`: 2.14.1 -\u003e 2.14.3\n    * `harfbuzz`: 12.3.0 -\u003e 12.3.2\n    * `icu4c`: 77_1 -\u003e 78.3\n    * `libgpg-error`: 1.56 -\u003e 1.59\n    * `liborcus`: 0.20.1 -\u003e 0.21.0\n    * `pdfium`: 7012 -\u003e 7471\n    * `poppler`: 25.12.0 -\u003e 26.04.0\n    * `skia`: m136 -\u003e m142\n  - New bundled sources:\n    * `afdko` 4.0.3\n    * `antlr4-cpp-runtime` 4.13.2\n    * `fast_float` 8.2.2\n    * `libffi` 3.5.2\n    * `lxml` 6.1.0\n    * `md4c` 0.5.2\n    * `meson` 1.8.3\n    * `Python` 3.12.13\n    * `sqlite` 3530000\n    * `xmlsec1` 1.3.9\n    * `xz` 5.8.3\n- Add `patch`, required to build the bundled Python on all architectures.\n- Bundling a specific Python is now required as the one we ship (3.6) is too old to build `harfbuzz`.\n","status":"published","published":"2026-07-20T18:01:16Z","modified":"2026-07-21T09:45:06.737566804Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}