CVE-2026-6045

Announced: Jun 15, 2026

Fixed in: LibreOffice 26.2.3 and LibreOffice 25.8.7

Description:

A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and then filled as if it were large, writing past its end.

In fixed versions the blend-point count is checked against the data actually available before allocating.

All users are recommended to upgrade to LibreOffice >= 26.2.3 or >= 25.8.7 to avoid this problem.

Credits:

Thanks to Anthropic for discovering this issue using automated analysis with Claude.

Thanks to Trail of Bits for triaging and validating this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

References:

CVE-2026-6045

CVE-2026-6045

Sledujte nás