LibreOffice EUVD-2026-36737

Exploitation requires a victim to open a maliciously crafted DOCX (OOXML format) file in a vulnerable version of LibreOffice - passive user interaction (UI:P) is the sole prerequisite. No authentication, no elevated privileges, and no special LibreOffice configuration are required; the default OOXML import functionality is sufficient to trigger the flaw. The attack vector is local (AV:L), meaning the DOCX file must be present on the local filesystem or accessible to the LibreOffice process at open time, but it can be delivered remotely via email attachment, web download, or shared drive. The limiting factors are: (1) the victim must actively open the malicious file, (2) the vulnerability is specific to text box elements within OOXML documents - benign DOCX files without specially structured text boxes will not trigger it, and (3) the impact is primarily availability (crash); escalation to arbitrary code execution depends on heap layout and exploit sophistication beyond POC stage.

The CVSS 4.0 base score of 5.4 (Medium) reflects a local attack vector (AV:L) requiring passive user interaction (UI:P), which moderates real-world reach compared to a fully remote, no-interaction flaw. However, the impact profile is asymmetric: VA:H indicates near-certain availability loss (crash), while VC:L and VI:L suggest limited but non-zero memory disclosure and integrity risk - consistent with a heap OOB write that may be partially controllable. The E:P supplemental metric confirms a proof-of-concept exploit exists, elevating concern beyond theoretical. No CISA KEV listing means no confirmed in-the-wild exploitation, but POC availability narrows the gap. EPSS data was not provided, so exploitation probability cannot be quantitatively stated. The local vector means exploitation requires delivering the malicious DOCX to a victim who then opens it - a realistic phishing or watering-hole scenario. For organizations where LibreOffice is used to open untrusted documents (e.g., finance, legal, public-sector desktops), this is a genuine patching priority given POC existence. No CVSS vector conflict detected: AV:L is consistent with a document-processing flaw requiring local file access.

An attacker crafts a malicious DOCX file containing a specially structured text box element designed to trigger the type confusion during OOXML import. The file is delivered via email attachment or download link; when a victim opens it in LibreOffice, the deferred parser event replay writes past the end of a heap allocation, causing a crash or potentially enabling controlled memory corruption. A proof-of-concept exploit exists (E:P), meaning the mechanics of triggering the overflow have been demonstrated publicly.