CVE-2026-6040
Announced: Jun 15, 2026
Fixed in: LibreOffice 26.2.3 and LibreOffice 25.8.7
Description:
LibreOffice supports a number format option that pads a number with blank space as wide as a chosen character.
A heap use-after-free existed when importing these blank-width characters from an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string.
In fixed versions the position is bounds-checked before use.
All users are recommended to upgrade to LibreOffice >= 26.2.3 or >= 25.8.7 to avoid this problem.
Credits:
Thanks to Anthropic for discovering this issue using automated analysis with Claude.
Thanks to Trail of Bits for triaging and validating this issue.
Thanks to Caolán McNamara of Collabora Productivity for providing a fix.
References:
Sledujte nás