LibreOffice EUVD-2026-36736

The victim must open a LibreOffice document embedding an EMF+ graphic that contains a gradient brush with a crafted blend point count engineered to overflow on multiplication. No non-default LibreOffice configuration is required - EMF+ import is a built-in standard capability active in default installations. User interaction is mandatory: the malicious file must be opened by the target. The local attack vector (AV:L) means the attacker cannot trigger this remotely without first delivering the document through email, messaging, or a download. Escalation from heap corruption to reliable controlled code execution requires additional exploitation effort beyond the initial overflow; a crash is the minimum guaranteed outcome. There are no authentication barriers in the traditional network sense - any user with access to LibreOffice and the ability to open a file is a viable target regardless of privilege level.

The CVSS 4.0 score of 5.4 (Medium) appropriately reflects meaningful constraints on exploitability: AV:L (local attack vector) requires the malicious file to execute within a user session rather than arriving as a pure network exploit, and UI:P mandates that the victim actively open the document. Availability impact is High (VA:H), consistent with a reliable process crash; confidentiality and integrity are both Low (VC:L/VI:L), reflecting that heap corruption may expose adjacent memory content or allow limited writes but controlled code execution is non-trivial. The E:P supplemental metric confirms a proof of concept exists, elevating practical risk above a theoretical-only flaw and reducing the skill threshold for reproducing the crash. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis. EPSS data was not provided. A key data gap is the absence of a specific patched version number in the available data; defenders must consult the vendor advisory for definitive version guidance. Overall risk priority is moderate: high for organizations whose users routinely open documents from untrusted sources, and substantially lower where document-vetting or sandboxing controls are in place.

An attacker crafts an ODT, DOCX, or presentation file embedding an EMF+ gradient brush whose blend point count is set to a value that, when multiplied by the element size, overflows to produce a small integer - causing LibreOffice to allocate a heap buffer far smaller than the data it writes into it. The attacker delivers the file via a phishing email or malicious download and persuades the victim to open it; upon rendering the EMF+ content LibreOffice overwrites adjacent heap memory, at minimum crashing the process and potentially enabling arbitrary code execution within the user's session. A proof of concept exists, reducing the skill required to reproduce the crash and develop further exploitation.