LibreOffice EUVD-2026-36735

Exploitation requires a user to open a specially crafted ODF document - spreadsheet (.ods) or text document (.odt) - containing a number format with an invalid blank-width position value that exceeds the format-code string length. No elevated privileges, authenticated session, special system configuration, or network-exposed service are required (PR:N, AT:N per CVSS 4.0). The attack vector is strictly local (AV:L): the malicious file must be present on or delivered to the target system, and a human user must open it (UI:P). Exploitation is limited by the passive user interaction gate - remote attackers cannot trigger the flaw without social engineering to cause the file to be opened. Non-ODF file formats (DOCX, XLSX, etc.) do not exercise this code path and are not affected.

The CVSS 4.0 base score of 5.4 (Medium) reflects a local attack vector with passive user interaction and no privilege requirement - accurately capturing a document-opening scenario. The high availability impact (VA:H) is the dominant signal, consistent with an application crash from heap memory corruption. Confidentiality (VC:L) and integrity (VI:L) impacts are limited, suggesting the UAF is exploitable for crash or partial memory read but not yet demonstrated to yield reliable arbitrary code execution from available data. The E:P supplemental metric confirms proof-of-concept exploit code exists, elevating practical risk beyond theoretical. No CISA KEV listing means active in-the-wild exploitation is not confirmed. EPSS data was not provided; given medium CVSS, POC availability, and the ubiquity of LibreOffice as a document editor, moderate opportunistic risk via spearphishing is a reasonable baseline assumption. The UI:P and AV:L constraints are the primary limiters - mass automated exploitation is not feasible without social engineering.

An attacker crafts an ODF spreadsheet embedding a number format string with a blank-width position value that exceeds the string's actual length, then delivers it to a target via phishing email or a malicious download link. When the victim opens the file in a vulnerable version of LibreOffice, the ODF import parser reads the unchecked position and dereferences a stale or out-of-bounds heap pointer, crashing the application and potentially leaking heap contents to a log or crash report. Because proof-of-concept code exists (CVSS 4.0 E:P), a motivated attacker could refine this primitive toward a more impactful exploit depending on heap layout and platform allocator behavior.