LibreOffice CVE-2026-6039

The victim must open a specially crafted DXF file in LibreOffice - this is the sole prerequisite. The DXF file must contain a polyline entity with a point count value greater than 65,535 (exceeding the 16-bit unsigned integer maximum of 0xFFFF) so that the allocation-versus-fill mismatch is triggered. No authentication, elevated privileges, special configuration, network exposure, or non-default LibreOffice settings are required. What limits exploitation is the mandatory user-interaction step: a human must actively open the malicious file, and the attack vector is local (AV:L per CVSS 4.0), meaning the attacker cannot trigger the parse remotely without a delivery mechanism such as email, USB, or file share. The vulnerability does not manifest in files containing only polylines with 65,535 or fewer points.

The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H) scores 5.4 (Medium), reflecting local delivery and passive user interaction as the primary risk-reducing factors. The availability impact is rated High (VA:H), consistent with a heap overflow that will reliably crash LibreOffice; confidentiality and integrity impacts are Low, indicating limited but non-zero potential for memory disclosure or controlled writes. The E:P supplemental metric confirms a proof-of-concept exists, which elevates practical exploitability above theoretical. No EPSS percentile was provided in the input data, and the CVE is not listed in CISA KEV, suggesting exploitation has not been observed at scale. The attack complexity is Low (AC:L) and no privileges are required (PR:N), but the local attack vector and mandatory user interaction (UI:P - the victim must open a file) meaningfully constrain real-world weaponization compared to network-exploitable flaws. The net assessment is a medium-priority vulnerability: reliable crash is straightforward and a PoC exists, but code execution requires additional exploit engineering and a social-engineering or malicious-file-delivery step.

An attacker constructs a malicious DXF file containing a POLYLINE entity whose declared point count exceeds 65,535 - for example, 70,000 points - ensuring the truncation bug triggers during import. The file is delivered to a target via email, file share, or a compromised download link, and the victim opens it in LibreOffice Draw or any LibreOffice component capable of importing DXF. The undersized heap buffer is overwritten with attacker-controlled polyline coordinate data, at minimum crashing LibreOffice; a proof-of-concept for this crash path exists per the CVSS 4.0 E:P metric, and a more sophisticated exploit could attempt heap-layout manipulation to achieve arbitrary code execution in the context of the LibreOffice process.