CVE-2026-8357

Announced: Jun 15, 2026

Fixed in: LibreOffice 26.2.4

Description:

A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end.

In fixed versions the array is sized to hold the largest possible nesting.

All users are recommended to upgrade to LibreOffice >= 26.2.4 to avoid this problem.

Credits:

Thanks to Anthropic for discovering this issue using automated analysis with Claude.

Thanks to Trail of Bits for triaging and validating this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

References:

CVE-2026-8357

CVE-2026-8357

Sledujte nás