Skip to main content

LibreOffice CVE-2026-4430

| EUVDEUVD-2026-28327 MEDIUM
Out-of-bounds Write (CWE-787)
2026-05-07 Document Fdn. GHSA-cwgp-8p97-cf77
5.4
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
7.6 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

5
Analysis Generated
May 07, 2026 - 10:00 vuln.today
Patch available
May 07, 2026 - 09:01 EUVD
CVSS changed
May 07, 2026 - 08:22 NVD
5.4 (MEDIUM)
CVE Published
May 07, 2026 - 07:16 nvd
UNKNOWN (no severity yet)
CVE Published
May 07, 2026 - 07:16 nvd
MEDIUM 5.4

DescriptionCVE.org

Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters.

This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.

AnalysisAI

Out-of-bounds write in LibreOffice 26.2 before 26.2.3 and 25.8 before 25.8.7 allows local attackers to cause memory corruption and availability impact by opening crafted OOXML documents with mismatched encryption salt parameters. The vulnerability requires user interaction to open a malicious document and affects memory integrity with elevated scope impact on availability.

Technical ContextAI

This vulnerability exists in LibreOffice's OOXML document parser, specifically in the encryption salt parameter handling logic. OOXML (Office Open XML) is the standardized format for Microsoft Office documents and is also used by LibreOffice. When processing Office documents with encryption, the parser must validate and synchronize encryption salt values; a mismatch between expected and actual salt parameters in the document structure causes the parser to write beyond allocated buffer boundaries. This is a classic CWE-787 (Out-of-bounds write) memory corruption vulnerability affecting the encryption/decryption subsystem. The CPE cpe:2.3:a:the_document_foundation:libreoffice:*:*:*:*:*:*:*:* confirms the vulnerability affects the mainstream LibreOffice product across multiple versions.

RemediationAI

Update LibreOffice to version 26.2.3 or later for the 26.2 branch, or to version 25.8.7 or later for the 25.8 branch. Vendor-released patches are confirmed available from The Document Foundation. As a compensating control before patching, users should disable automatic opening of attachments from untrusted sources and implement document scanning or sandboxing for OOXML files from external parties. Note that sandboxing LibreOffice can prevent system-wide impact but does not prevent the application crash within the sandboxed process. For enterprise deployments, restrict OOXML document processing to trusted internal sources until patches can be applied. See https://www.libreoffice.org/about-us/security/advisories/cve-2026-4430 for official vendor guidance.

CVE-2019-9851 CRITICAL POC
9.8 Aug 15

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitra

CVE-2015-5212 MEDIUM
6.8 Nov 10

Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load p

CVE-2015-5214 MEDIUM
6.8 Nov 10

LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a deni

CVE-2018-6871 CRITICAL POC
9.8 Feb 09

LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a

CVE-2021-25631 HIGH POC
8.8 May 03

In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist

CVE-2012-2334 MEDIUM POC
6.8 Jun 19

Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and

CVE-2018-10583 HIGH POC
7.5 May 01

An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically p

CVE-2014-3524 CRITICAL
9.3 Aug 26

Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified

CVE-2015-5213 MEDIUM
6.8 Nov 10

Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denia

CVE-2014-0247 CRITICAL
10.0 Jul 03

LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possib

CVE-2012-0037 MEDIUM POC
6.5 Jun 17

Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x

CVE-2017-7856 CRITICAL
9.8 Apr 14

LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::Imp

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed

Share

CVE-2026-4430 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy