{"id":"CVE-2026-8358","aliases":["DEBIAN-CVE-2026-8358","EUVD-2026-36740","GHSA-gpc5-jgqj-xp2q","MGASA-2026-0259","SUSE-SU-2026:3140-1","UBUNTU-CVE-2026-8358","USN-8534-1","openSUSE-SU-2026:22216-1"],"status":"published","title":"Heap buffer overflow in spreadsheet tracked-changes import","description":"LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00226,"percentile":0.13442,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787","CWE-843"],"published":"2026-06-15T16:24:03Z","modified":"2026-11-04T17:23:23Z","fixes":[{"ecosystem":"Debian:12","package":"libreoffice","fixed_in":["4:7.4.7-1+deb12u13"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libreoffice","fixed_in":["4:25.2.3-2+deb13u5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libreoffice","fixed_in":["4:26.2.4.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","fixed_in":["1:7.3.7-0ubuntu0.22.04.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","fixed_in":["4:24.2.7-0ubuntu0.24.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","fixed_in":["4:26.2.4.2-0ubuntu0.26.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:7.4.7-1+deb12u13"}]}],"versions":["4:7.4.5-3","4:7.4.7-1","4:7.4.7-1+deb12u1","4:7.4.7-1+deb12u10","4:7.4.7-1+deb12u11","4:7.4.7-1+deb12u12","4:7.4.7-1+deb12u1~bpo11+1","4:7.4.7-1+deb12u2","4:7.4.7-1+deb12u2~bpo11+1","4:7.4.7-1+deb12u3","4:7.4.7-1+deb12u4","4:7.4.7-1+deb12u5","4:7.4.7-1+deb12u6","4:7.4.7-1+deb12u7","4:7.4.7-1+deb12u8","4:7.4.7-1+deb12u9","4:7.4.7-1~bpo11+1"]},{"source":"osv","ecosystem":"Debian:13","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:25.2.3-2+deb13u5"}]}],"versions":["4:25.2.3-2","4:25.2.3-2+deb13u1","4:25.2.3-2+deb13u2","4:25.2.3-2+deb13u2~bpo12+1","4:25.2.3-2+deb13u3","4:25.2.3-2+deb13u3~bpo12+1","4:25.2.3-2+deb13u4","4:25.2.3-2+deb13u5~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.4.2-1"}]}],"versions":["4:25.2.3-2","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2","4:26.2.3.2-2~bpo13+1","4:26.2.4.1-1","4:26.2.4.2-1~bpo13+1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.4.2-1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2.7.2-1.5.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.1-150500.20.37.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.1-150500.20.37.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.3.2-0ubuntu2","1:6.3.3-0ubuntu1","1:6.3.3-0ubuntu2","1:6.3.4-0ubuntu1","1:6.4.0-0ubuntu4","1:6.4.0-0ubuntu6","1:6.4.0-0ubuntu7","1:6.4.1-0ubuntu1","1:6.4.2-0ubuntu1","1:6.4.2-0ubuntu2","1:6.4.2-0ubuntu3","1:6.4.3-0ubuntu0.20.04.1","1:6.4.4-0ubuntu0.20.04.1","1:6.4.5-0ubuntu0.20.04.1","1:6.4.6-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.2","1:6.4.7-0ubuntu0.20.04.4","1:6.4.7-0ubuntu0.20.04.5","1:6.4.7-0ubuntu0.20.04.6","1:6.4.7-0ubuntu0.20.04.7","1:6.4.7-0ubuntu0.20.04.8","1:6.4.7-0ubuntu0.20.04.9","1:6.4.7-0ubuntu0.20.04.10","1:6.4.7-0ubuntu0.20.04.11","1:6.4.7-0ubuntu0.20.04.12","1:6.4.7-0ubuntu0.20.04.13","1:6.4.7-0ubuntu0.20.04.14","1:6.4.7-0ubuntu0.20.04.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3.7-0ubuntu0.22.04.12"}]}],"versions":["1:7.2.1-0ubuntu3","1:7.2.2-0ubuntu0.21.10.1","1:7.2.3~rc2-0ubuntu1","1:7.2.4-0ubuntu1","1:7.2.5~rc1-0ubuntu2","1:7.2.5~rc2-0ubuntu1","1:7.3.1~rc2-0ubuntu1","1:7.3.1~rc3-0ubuntu1","1:7.3.2~rc1-0ubuntu2","1:7.3.2~rc2-0ubuntu1","1:7.3.2-0ubuntu1","1:7.3.2-0ubuntu2","1:7.3.3-0ubuntu0.22.04.1","1:7.3.4-0ubuntu0.22.04.1","1:7.3.5-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.1","1:7.3.7-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.3","1:7.3.7-0ubuntu0.22.04.4","1:7.3.7-0ubuntu0.22.04.5","1:7.3.7-0ubuntu0.22.04.6","1:7.3.7-0ubuntu0.22.04.7","1:7.3.7-0ubuntu0.22.04.8","1:7.3.7-0ubuntu0.22.04.9","1:7.3.7-0ubuntu0.22.04.10","1:7.3.7-0ubuntu0.22.04.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.2.7-0ubuntu0.24.04.6"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:25.2.2-0ubuntu1","4:25.2.3-0ubuntu1","4:25.2.3-0ubuntu3","4:25.2.4~rc3-0ubuntu1","4:25.2.5~rc1-0ubuntu1","4:25.2.5-0ubuntu1","4:25.8.0~rc2-0ubuntu1","4:25.8.0~rc2-0ubuntu2","4:25.8.0~rc3-0ubuntu1","4:25.8.0~rc4-0ubuntu1","4:25.8.1~rc1-0ubuntu1","4:25.8.2-0ubuntu0.25.10.1","4:25.8.3-0ubuntu0.25.10.1","4:25.8.4-0ubuntu0.25.10.1","4:25.8.5-0ubuntu0.25.10.1","4:25.8.6-0ubuntu0.25.10.1","4:25.8.7-0ubuntu0.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.4.2-0ubuntu0.26.04.2"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3.7-0ubuntu0.22.04.12"}]}],"versions":["1:7.2.1-0ubuntu3","1:7.2.2-0ubuntu0.21.10.1","1:7.2.3~rc2-0ubuntu1","1:7.2.4-0ubuntu1","1:7.2.5~rc1-0ubuntu2","1:7.2.5~rc2-0ubuntu1","1:7.3.1~rc2-0ubuntu1","1:7.3.1~rc3-0ubuntu1","1:7.3.2~rc1-0ubuntu2","1:7.3.2~rc2-0ubuntu1","1:7.3.2-0ubuntu1","1:7.3.2-0ubuntu2","1:7.3.3-0ubuntu0.22.04.1","1:7.3.4-0ubuntu0.22.04.1","1:7.3.5-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.1","1:7.3.7-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.3","1:7.3.7-0ubuntu0.22.04.4","1:7.3.7-0ubuntu0.22.04.5","1:7.3.7-0ubuntu0.22.04.6","1:7.3.7-0ubuntu0.22.04.7","1:7.3.7-0ubuntu0.22.04.8","1:7.3.7-0ubuntu0.22.04.9","1:7.3.7-0ubuntu0.22.04.10","1:7.3.7-0ubuntu0.22.04.11"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.2.7-0ubuntu0.24.04.6"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.4.2-0ubuntu0.26.04.2"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.8.1.1-bp160.1.1"}]}],"bundled":8}],"products":[{"vendor":"the document foundation","product":"libreoffice"}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-8358"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8358"},{"url":"https://github.com/advisories/GHSA-gpc5-jgqj-xp2q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-8358","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0259.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35709","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00257.html","tags":["web"]},{"url":"https://www.libreoffice.org/security/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263140-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264357","tags":["report"]},{"url":"https://bugzilla.suse.com/1267735","tags":["report"]},{"url":"https://bugzilla.suse.com/1268494","tags":["report"]},{"url":"https://bugzilla.suse.com/1268497","tags":["report"]},{"url":"https://bugzilla.suse.com/1268504","tags":["report"]},{"url":"https://bugzilla.suse.com/1268522","tags":["report"]},{"url":"https://bugzilla.suse.com/1268527","tags":["report"]},{"url":"https://bugzilla.suse.com/1268528","tags":["report"]},{"url":"https://bugzilla.suse.com/1268529","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8358","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-8358","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8358","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8534-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8357","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-8358","title":"Heap buffer overflow in spreadsheet tracked-changes import","description":"LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected.","status":"published","published":"2026-06-15T16:24:03.796Z","modified":"2026-06-16T19:27:16.142Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-843","CWE-787"],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-36740","description":"LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected.","status":"published","published":"2026-06-15T16:24:03Z","modified":"2026-06-16T19:27:16Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T18:20:39.851172Z"}],"ghsa":[{"id":"GHSA-gpc5-jgqj-xp2q","title":"LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow...","description":"LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected.","status":"published","published":"2026-06-15T18:31:19Z","modified":"2026-06-15T18:31:25Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:08:46.336077Z"}],"nvd":[{"id":"CVE-2026-8358","description":"LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected.","status":"published","published":"2026-06-15T18:16:37.63Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-787","CWE-843"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"DEBIAN-CVE-2026-8358","description":"LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected.","status":"published","published":"2026-06-15T18:16:37.63Z","modified":"2026-10-26T11:47:34.859127982Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"UBUNTU-CVE-2026-8358","description":"LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected.","status":"published","published":"2026-06-15T18:16:00Z","modified":"2026-07-14T02:01:50.249564058Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"MGASA-2026-0259","title":"Updated libreoffice packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nHeap buffer overflow in DXF polyline import. (CVE-2026-6039)\nHeap use-after-free in ODF number-format blank-width parsing.\n(CVE-2026-6040)\nHeap buffer overflow in EMF+ gradient brush import. (CVE-2026-6045)\nStack buffer overflow in PPT presentation import. (CVE-2026-8356)\nHeap buffer overflow in Calc formula compilation. (CVE-2026-8357)\nHeap buffer overflow in spreadsheet tracked-changes import.\n(CVE-2026-8358)\n","status":"published","published":"2026-07-18T05:48:16Z","modified":"2026-07-18T06:00:05.202862912Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:22216-1","title":"Security update for libreoffice","description":"This update for libreoffice fixes the following issues:\n\nChanges in libreoffice:\n\n- Upgrade to 26.8.1.1.\n\n- Perfect spec file sync between Factory, SLE and Leap 16.X.\n\n- Update to LibreOffice 26.2.5.1 (was 25.2.5.2).\n\n- Fix the following security issues:\n  * CVE-2026-6039 (bsc#1268494): Denial of Service via a specially\n    crafted DXF polyline import.\n  * CVE-2026-6045 (bsc#1268497): Heap buffer overflow via crafted\n    EMF+ graphics import.\n  * CVE-2026-6047 (bsc#1268504): Denial of Service via heap buffer\n    overflow in OOXML document processing.\n  * CVE-2026-8356 (bsc#1268522): Denial of Service via a specially\n    crafted PPT file.\n  * CVE-2026-6040 (bsc#1268527): Heap use-after-free when importing\n    the blank-width characters of an ODF number format.\n  * CVE-2026-8357 (bsc#1268528): Heap buffer overflow in Calc\n    formula compilation.\n  * CVE-2026-8358 (bsc#1268529): Heap buffer overflow in spreadsheet\n    tracked-changes import.\n  * CVE-2026-4430 (bsc#1264357): Out-of-bounds write via crafted\n    OOXML documents with mismatched encryption salt parameters.\n","status":"published","published":"2026-11-03T10:21:52Z","modified":"2026-11-04T17:23:23.836832996Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:3140-1","title":"Security update for libreoffice","description":"This update for libreoffice fixes the following issues:\n\nUpdate to LibreOffice 26.2.5.1.\n\nSecurity issues fixed:\n\n- CVE-2026-4430: out-of-bounds write via crafted OOXML documents with mismatched encryption salt parameters\n  (bsc#1264357).\n- CVE-2026-6039: denial of service via specially crafted DXF polyline import (bsc#1268494).\n- CVE-2026-6040: heap use-after-free when importing the blank-width characters of an ODF number format (bsc#1268527).\n- CVE-2026-6045: heap buffer overflow via crafted EMF+ graphics import (bsc#1268497).\n- CVE-2026-6047: denial of service via heap buffer overflow in OOXML document processing (bsc#1268504).\n- CVE-2026-8356: denial of service via a specially crafted PPT file (bsc#1268522).\n- CVE-2026-8357: heap buffer overflow in Calc formula compilation (bsc#1268528).\n- CVE-2026-8358: heap buffer overflow in spreadsheet tracked-changes import (bsc#1268529).\n- CVE-2026-50593: graphite2: out-of-bounds write via Graphite actions (bsc#1267735).\n\nOther updates and bugfixes:\n\n- Update to LibreOffice 26.2.5.1.\n  - Update bundled dependencies:\n    * `fontconfig` 2.17.1 -\u003e 2.18.0\n    * `graphite2-minimal` 1.3.14 -\u003e 1.3.15\n    * `libcmis` 0.6.2 -\u003e 0.6.3\n    * `libgpg-error` 1.59 -\u003e 1.61\n    * `lxml` 6.1.0 -\u003e 6.1.1\n    * `md4c` 0.5.2 -\u003e 0.5.3\n    * `poppler` 26.04.0 -\u003e 26.06.0\n    * `sqlite-amalgamation` 3530000 -\u003e 3530100\n    * `xmlsec1` 1.3.9 -\u003e 1.3.11\n- Update to LibreOffice 26.2.3.2 (PED-16098).\n  - Upgraded dependencies:\n    * `boost`: 1_88_0 -\u003e 1_89_0\n    * `freetype`: 2.14.1 -\u003e 2.14.3\n    * `harfbuzz`: 12.3.0 -\u003e 12.3.2\n    * `icu4c`: 77_1 -\u003e 78.3\n    * `libgpg-error`: 1.56 -\u003e 1.59\n    * `liborcus`: 0.20.1 -\u003e 0.21.0\n    * `pdfium`: 7012 -\u003e 7471\n    * `poppler`: 25.12.0 -\u003e 26.04.0\n    * `skia`: m136 -\u003e m142\n  - New bundled sources:\n    * `afdko` 4.0.3\n    * `antlr4-cpp-runtime` 4.13.2\n    * `fast_float` 8.2.2\n    * `libffi` 3.5.2\n    * `lxml` 6.1.0\n    * `md4c` 0.5.2\n    * `meson` 1.8.3\n    * `Python` 3.12.13\n    * `sqlite` 3530000\n    * `xmlsec1` 1.3.9\n    * `xz` 5.8.3\n- Add `patch`, required to build the bundled Python on all architectures.\n- Bundling a specific Python is now required as the one we ship (3.6) is too old to build `harfbuzz`.\n","status":"published","published":"2026-07-20T18:01:16Z","modified":"2026-07-21T09:45:06.737566804Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8534-1","title":"libreoffice vulnerabilities","description":"It was discovered that LibreOffice incorrectly handled importing DXF\ndrawings. An attacker could use this issue to cause LibreOffice to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2026-6039)\n\nIt was discovered that LibreOffice incorrectly handled certain ODF number\nformats. An attacker could use this issue to cause LibreOffice to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-6040)\n\nIt was discovered that LibreOffice incorrectly handled importing EMF+\ngraphics. An attacker could use this issue to cause LibreOffice to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2026-6045)\n\nIt was discovered that LibreOffice incorrectly handled importing PPT\npresentations. An attacker could use this issue to cause LibreOffice to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2026-8356)\n\nIt was discovered that LibreOffice Calc incorrectly handled compiling\ncertain formulas. An attacker could use this issue to cause LibreOffice to\ncrash, resulting in a denial of service, or possily execute arbitrary code.\n(CVE-2026-8357)\n\nIt was discovered that LibreOffice Calc incorrectly handled importing\nspreadsheet tracked changes. An attacker could use this issue to cause\nLibreOffice to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2026-8358)","status":"published","published":"2026-07-13T15:04:25Z","modified":"2026-07-14T02:11:33.191233485Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}