LibreOffice EUVD-2026-28327

User must actively open a crafted OOXML document in LibreOffice. No special LibreOffice configuration is required - the vulnerability exists in the default document parsing path for any .docx, .xlsx, .pptx or related Office document format. The document must contain encryption parameters; unencrypted or validly-encrypted documents will not trigger the out-of-bounds write. Attack requires local file system access or the ability to deliver a file to the target user (via email, USB, shared folder, etc.). Remote network-based delivery is possible only as a distribution mechanism; the actual exploitation requires local user action to open the file.

CVSS 5.4 with local attack vector (AV:L) indicates this requires local file access and user interaction (UI:P) to trigger. The CVSS vector shows low confidentiality and integrity impact (VC:L, VI:L) but high availability impact (VA:H), meaning the primary damage from successful exploitation is denial of service through memory corruption or application crash rather than data theft. Attack complexity is low (AC:L) and no privileges required (PR:N), so any local user can exploit this by crafting a malicious OOXML file. The exploitability score 'P' (Proof-of-concept available) and active vendor patching signal real-world risk despite the moderate CVSS score. The requirement for local access and user interaction significantly constrains real-world blast radius compared to a network-based vulnerability; this is not a widespread threat but poses targeted risk in environments where users receive untrusted documents. The high availability impact combined with low complexity makes this a priority for availability-sensitive deployments.

An attacker crafts a malicious OOXML document (e.g., .docx, .xlsx) with deliberately mismatched encryption salt parameters and distributes it via email or file-sharing. When a user opens the document in a vulnerable LibreOffice version, the parser attempts to decrypt the content but writes beyond allocated memory buffers due to salt length mismatch, causing a memory corruption exception that crashes the application and potentially corrupts the user's session or temp files.