{"id":"CVE-2026-8356","aliases":["DEBIAN-CVE-2026-8356","EUVD-2026-36738","GHSA-8r7p-3qw5-wxm5","MGASA-2026-0259","SUSE-SU-2026:3140-1","UBUNTU-CVE-2026-8356","USN-8534-1","openSUSE-SU-2026:22216-1"],"status":"published","title":"Stack buffer overflow in PPT presentation import","description":"LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00154,"percentile":0.04577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2026-06-15T16:23:06Z","modified":"2026-11-04T17:23:23Z","fixes":[{"ecosystem":"Debian:12","package":"libreoffice","fixed_in":["4:7.4.7-1+deb12u13"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libreoffice","fixed_in":["4:25.2.3-2+deb13u5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libreoffice","fixed_in":["4:26.2.4.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","fixed_in":["1:7.3.7-0ubuntu0.22.04.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","fixed_in":["4:24.2.7-0ubuntu0.24.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","fixed_in":["4:26.2.4.2-0ubuntu0.26.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:7.4.7-1+deb12u13"}]}],"versions":["4:7.4.5-3","4:7.4.7-1","4:7.4.7-1+deb12u1","4:7.4.7-1+deb12u10","4:7.4.7-1+deb12u11","4:7.4.7-1+deb12u12","4:7.4.7-1+deb12u1~bpo11+1","4:7.4.7-1+deb12u2","4:7.4.7-1+deb12u2~bpo11+1","4:7.4.7-1+deb12u3","4:7.4.7-1+deb12u4","4:7.4.7-1+deb12u5","4:7.4.7-1+deb12u6","4:7.4.7-1+deb12u7","4:7.4.7-1+deb12u8","4:7.4.7-1+deb12u9","4:7.4.7-1~bpo11+1"]},{"source":"osv","ecosystem":"Debian:13","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:25.2.3-2+deb13u5"}]}],"versions":["4:25.2.3-2","4:25.2.3-2+deb13u1","4:25.2.3-2+deb13u2","4:25.2.3-2+deb13u2~bpo12+1","4:25.2.3-2+deb13u3","4:25.2.3-2+deb13u3~bpo12+1","4:25.2.3-2+deb13u4","4:25.2.3-2+deb13u5~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.4.2-1"}]}],"versions":["4:25.2.3-2","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2","4:26.2.3.2-2~bpo13+1","4:26.2.4.1-1","4:26.2.4.2-1~bpo13+1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.4.2-1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2.7.2-1.5.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.1-150500.20.37.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.1-150500.20.37.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.3.2-0ubuntu2","1:6.3.3-0ubuntu1","1:6.3.3-0ubuntu2","1:6.3.4-0ubuntu1","1:6.4.0-0ubuntu4","1:6.4.0-0ubuntu6","1:6.4.0-0ubuntu7","1:6.4.1-0ubuntu1","1:6.4.2-0ubuntu1","1:6.4.2-0ubuntu2","1:6.4.2-0ubuntu3","1:6.4.3-0ubuntu0.20.04.1","1:6.4.4-0ubuntu0.20.04.1","1:6.4.5-0ubuntu0.20.04.1","1:6.4.6-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.2","1:6.4.7-0ubuntu0.20.04.4","1:6.4.7-0ubuntu0.20.04.5","1:6.4.7-0ubuntu0.20.04.6","1:6.4.7-0ubuntu0.20.04.7","1:6.4.7-0ubuntu0.20.04.8","1:6.4.7-0ubuntu0.20.04.9","1:6.4.7-0ubuntu0.20.04.10","1:6.4.7-0ubuntu0.20.04.11","1:6.4.7-0ubuntu0.20.04.12","1:6.4.7-0ubuntu0.20.04.13","1:6.4.7-0ubuntu0.20.04.14","1:6.4.7-0ubuntu0.20.04.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3.7-0ubuntu0.22.04.12"}]}],"versions":["1:7.2.1-0ubuntu3","1:7.2.2-0ubuntu0.21.10.1","1:7.2.3~rc2-0ubuntu1","1:7.2.4-0ubuntu1","1:7.2.5~rc1-0ubuntu2","1:7.2.5~rc2-0ubuntu1","1:7.3.1~rc2-0ubuntu1","1:7.3.1~rc3-0ubuntu1","1:7.3.2~rc1-0ubuntu2","1:7.3.2~rc2-0ubuntu1","1:7.3.2-0ubuntu1","1:7.3.2-0ubuntu2","1:7.3.3-0ubuntu0.22.04.1","1:7.3.4-0ubuntu0.22.04.1","1:7.3.5-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.1","1:7.3.7-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.3","1:7.3.7-0ubuntu0.22.04.4","1:7.3.7-0ubuntu0.22.04.5","1:7.3.7-0ubuntu0.22.04.6","1:7.3.7-0ubuntu0.22.04.7","1:7.3.7-0ubuntu0.22.04.8","1:7.3.7-0ubuntu0.22.04.9","1:7.3.7-0ubuntu0.22.04.10","1:7.3.7-0ubuntu0.22.04.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.2.7-0ubuntu0.24.04.6"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:25.2.2-0ubuntu1","4:25.2.3-0ubuntu1","4:25.2.3-0ubuntu3","4:25.2.4~rc3-0ubuntu1","4:25.2.5~rc1-0ubuntu1","4:25.2.5-0ubuntu1","4:25.8.0~rc2-0ubuntu1","4:25.8.0~rc2-0ubuntu2","4:25.8.0~rc3-0ubuntu1","4:25.8.0~rc4-0ubuntu1","4:25.8.1~rc1-0ubuntu1","4:25.8.2-0ubuntu0.25.10.1","4:25.8.3-0ubuntu0.25.10.1","4:25.8.4-0ubuntu0.25.10.1","4:25.8.5-0ubuntu0.25.10.1","4:25.8.6-0ubuntu0.25.10.1","4:25.8.7-0ubuntu0.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.4.2-0ubuntu0.26.04.2"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3.7-0ubuntu0.22.04.12"}]}],"versions":["1:7.2.1-0ubuntu3","1:7.2.2-0ubuntu0.21.10.1","1:7.2.3~rc2-0ubuntu1","1:7.2.4-0ubuntu1","1:7.2.5~rc1-0ubuntu2","1:7.2.5~rc2-0ubuntu1","1:7.3.1~rc2-0ubuntu1","1:7.3.1~rc3-0ubuntu1","1:7.3.2~rc1-0ubuntu2","1:7.3.2~rc2-0ubuntu1","1:7.3.2-0ubuntu1","1:7.3.2-0ubuntu2","1:7.3.3-0ubuntu0.22.04.1","1:7.3.4-0ubuntu0.22.04.1","1:7.3.5-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.1","1:7.3.7-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.3","1:7.3.7-0ubuntu0.22.04.4","1:7.3.7-0ubuntu0.22.04.5","1:7.3.7-0ubuntu0.22.04.6","1:7.3.7-0ubuntu0.22.04.7","1:7.3.7-0ubuntu0.22.04.8","1:7.3.7-0ubuntu0.22.04.9","1:7.3.7-0ubuntu0.22.04.10","1:7.3.7-0ubuntu0.22.04.11"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.2.7-0ubuntu0.24.04.6"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.4.2-0ubuntu0.26.04.2"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.8.1.1-bp160.1.1"}]}],"bundled":8}],"products":[{"vendor":"the document foundation","product":"libreoffice"}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-8356","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8356"},{"url":"https://github.com/advisories/GHSA-8r7p-3qw5-wxm5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-8356","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0259.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35709","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00257.html","tags":["web"]},{"url":"https://www.libreoffice.org/security/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263140-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264357","tags":["report"]},{"url":"https://bugzilla.suse.com/1267735","tags":["report"]},{"url":"https://bugzilla.suse.com/1268494","tags":["report"]},{"url":"https://bugzilla.suse.com/1268497","tags":["report"]},{"url":"https://bugzilla.suse.com/1268504","tags":["report"]},{"url":"https://bugzilla.suse.com/1268522","tags":["report"]},{"url":"https://bugzilla.suse.com/1268527","tags":["report"]},{"url":"https://bugzilla.suse.com/1268528","tags":["report"]},{"url":"https://bugzilla.suse.com/1268529","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8358","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-8356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8356","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8534-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8358","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-8356","title":"Stack buffer overflow in PPT presentation import","description":"LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.","status":"published","published":"2026-06-15T16:23:06.477Z","modified":"2026-06-15T18:05:22.786Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-787","CWE-121"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-36738","description":"LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.","status":"published","published":"2026-06-15T16:23:06Z","modified":"2026-06-15T18:05:22Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T18:20:41.888684Z"}],"ghsa":[{"id":"GHSA-8r7p-3qw5-wxm5","title":"LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow...","description":"LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.","status":"published","published":"2026-06-15T18:31:19Z","modified":"2026-06-15T18:31:25Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:08:46.336077Z"}],"nvd":[{"id":"CVE-2026-8356","description":"LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.","status":"published","published":"2026-06-15T18:16:37.39Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"DEBIAN-CVE-2026-8356","description":"LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.","status":"published","published":"2026-06-15T18:16:37.39Z","modified":"2026-10-26T11:47:30.338648769Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"UBUNTU-CVE-2026-8356","description":"LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.","status":"published","published":"2026-06-15T18:16:00Z","modified":"2026-07-14T02:01:52.666393687Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"MGASA-2026-0259","title":"Updated libreoffice packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nHeap buffer overflow in DXF polyline import. (CVE-2026-6039)\nHeap use-after-free in ODF number-format blank-width parsing.\n(CVE-2026-6040)\nHeap buffer overflow in EMF+ gradient brush import. (CVE-2026-6045)\nStack buffer overflow in PPT presentation import. (CVE-2026-8356)\nHeap buffer overflow in Calc formula compilation. (CVE-2026-8357)\nHeap buffer overflow in spreadsheet tracked-changes import.\n(CVE-2026-8358)\n","status":"published","published":"2026-07-18T05:48:16Z","modified":"2026-07-18T06:00:05.202862912Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:22216-1","title":"Security update for libreoffice","description":"This update for libreoffice fixes the following issues:\n\nChanges in libreoffice:\n\n- Upgrade to 26.8.1.1.\n\n- Perfect spec file sync between Factory, SLE and Leap 16.X.\n\n- Update to LibreOffice 26.2.5.1 (was 25.2.5.2).\n\n- Fix the following security issues:\n  * CVE-2026-6039 (bsc#1268494): Denial of Service via a specially\n    crafted DXF polyline import.\n  * CVE-2026-6045 (bsc#1268497): Heap buffer overflow via crafted\n    EMF+ graphics import.\n  * CVE-2026-6047 (bsc#1268504): Denial of Service via heap buffer\n    overflow in OOXML document processing.\n  * CVE-2026-8356 (bsc#1268522): Denial of Service via a specially\n    crafted PPT file.\n  * CVE-2026-6040 (bsc#1268527): Heap use-after-free when importing\n    the blank-width characters of an ODF number format.\n  * CVE-2026-8357 (bsc#1268528): Heap buffer overflow in Calc\n    formula compilation.\n  * CVE-2026-8358 (bsc#1268529): Heap buffer overflow in spreadsheet\n    tracked-changes import.\n  * CVE-2026-4430 (bsc#1264357): Out-of-bounds write via crafted\n    OOXML documents with mismatched encryption salt parameters.\n","status":"published","published":"2026-11-03T10:21:52Z","modified":"2026-11-04T17:23:23.836832996Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:3140-1","title":"Security update for libreoffice","description":"This update for libreoffice fixes the following issues:\n\nUpdate to LibreOffice 26.2.5.1.\n\nSecurity issues fixed:\n\n- CVE-2026-4430: out-of-bounds write via crafted OOXML documents with mismatched encryption salt parameters\n  (bsc#1264357).\n- CVE-2026-6039: denial of service via specially crafted DXF polyline import (bsc#1268494).\n- CVE-2026-6040: heap use-after-free when importing the blank-width characters of an ODF number format (bsc#1268527).\n- CVE-2026-6045: heap buffer overflow via crafted EMF+ graphics import (bsc#1268497).\n- CVE-2026-6047: denial of service via heap buffer overflow in OOXML document processing (bsc#1268504).\n- CVE-2026-8356: denial of service via a specially crafted PPT file (bsc#1268522).\n- CVE-2026-8357: heap buffer overflow in Calc formula compilation (bsc#1268528).\n- CVE-2026-8358: heap buffer overflow in spreadsheet tracked-changes import (bsc#1268529).\n- CVE-2026-50593: graphite2: out-of-bounds write via Graphite actions (bsc#1267735).\n\nOther updates and bugfixes:\n\n- Update to LibreOffice 26.2.5.1.\n  - Update bundled dependencies:\n    * `fontconfig` 2.17.1 -\u003e 2.18.0\n    * `graphite2-minimal` 1.3.14 -\u003e 1.3.15\n    * `libcmis` 0.6.2 -\u003e 0.6.3\n    * `libgpg-error` 1.59 -\u003e 1.61\n    * `lxml` 6.1.0 -\u003e 6.1.1\n    * `md4c` 0.5.2 -\u003e 0.5.3\n    * `poppler` 26.04.0 -\u003e 26.06.0\n    * `sqlite-amalgamation` 3530000 -\u003e 3530100\n    * `xmlsec1` 1.3.9 -\u003e 1.3.11\n- Update to LibreOffice 26.2.3.2 (PED-16098).\n  - Upgraded dependencies:\n    * `boost`: 1_88_0 -\u003e 1_89_0\n    * `freetype`: 2.14.1 -\u003e 2.14.3\n    * `harfbuzz`: 12.3.0 -\u003e 12.3.2\n    * `icu4c`: 77_1 -\u003e 78.3\n    * `libgpg-error`: 1.56 -\u003e 1.59\n    * `liborcus`: 0.20.1 -\u003e 0.21.0\n    * `pdfium`: 7012 -\u003e 7471\n    * `poppler`: 25.12.0 -\u003e 26.04.0\n    * `skia`: m136 -\u003e m142\n  - New bundled sources:\n    * `afdko` 4.0.3\n    * `antlr4-cpp-runtime` 4.13.2\n    * `fast_float` 8.2.2\n    * `libffi` 3.5.2\n    * `lxml` 6.1.0\n    * `md4c` 0.5.2\n    * `meson` 1.8.3\n    * `Python` 3.12.13\n    * `sqlite` 3530000\n    * `xmlsec1` 1.3.9\n    * `xz` 5.8.3\n- Add `patch`, required to build the bundled Python on all architectures.\n- Bundling a specific Python is now required as the one we ship (3.6) is too old to build `harfbuzz`.\n","status":"published","published":"2026-07-20T18:01:16Z","modified":"2026-07-21T09:45:06.737566804Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8534-1","title":"libreoffice vulnerabilities","description":"It was discovered that LibreOffice incorrectly handled importing DXF\ndrawings. An attacker could use this issue to cause LibreOffice to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2026-6039)\n\nIt was discovered that LibreOffice incorrectly handled certain ODF number\nformats. An attacker could use this issue to cause LibreOffice to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-6040)\n\nIt was discovered that LibreOffice incorrectly handled importing EMF+\ngraphics. An attacker could use this issue to cause LibreOffice to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2026-6045)\n\nIt was discovered that LibreOffice incorrectly handled importing PPT\npresentations. An attacker could use this issue to cause LibreOffice to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2026-8356)\n\nIt was discovered that LibreOffice Calc incorrectly handled compiling\ncertain formulas. An attacker could use this issue to cause LibreOffice to\ncrash, resulting in a denial of service, or possily execute arbitrary code.\n(CVE-2026-8357)\n\nIt was discovered that LibreOffice Calc incorrectly handled importing\nspreadsheet tracked changes. An attacker could use this issue to cause\nLibreOffice to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2026-8358)","status":"published","published":"2026-07-13T15:04:25Z","modified":"2026-07-14T02:11:33.191233485Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}