LibreOffice EUVD-2026-36738

Exploitation requires the victim to open a specially crafted PPT (legacy binary PowerPoint) file in LibreOffice - specifically a file containing a colour-replacement record with a combined colour count across two parsing passes that exceeds the fixed-size stack colour tables. The attack vector is local (AV:L) because the file must be opened by the user on a machine running LibreOffice (UI:P passive interaction). No attacker privileges are required (PR:N) and no special system configuration is needed beyond a standard LibreOffice installation, which includes PPT import support by default. Exploitation is strictly limited to the PPT legacy binary format - PPTX (Open XML) and ODP files are not affected by this parser path. Platform stack mitigations (stack canaries, ASLR, SafeStack) will raise the bar for achieving reliable code execution beyond a crash, though a reliable crash-based DoS primitive is achievable. No network-reachable attack surface exists; the attacker must deliver the file to the victim through social engineering.

The CVSS 4.0 score of 5.4 reflects a medium-severity, file-based local attack (AV:L/UI:P) where the victim must open a malicious PPT file - a realistic social-engineering vector despite the 'local' classification. Attack complexity is low (AC:L) with no attacker privileges required (PR:N) and no specific attack preconditions (AT:N). The primary impact is availability (VA:H), consistent with a stack overflow that reliably crashes the application; secondary confidentiality and integrity impacts (VC:L/VI:L) reflect the theoretical possibility of controlled code execution, though this is harder to achieve in practice with modern stack protections. The E:P supplemental metric confirms proof-of-concept code exists, making this more actionable than a typical medium-severity finding. KEV status is not confirmed and EPSS data is not available in the provided intelligence, so widespread active exploitation cannot be assumed. The absence of scope change to subsequent systems (SC:N/SI:N/SA:N) limits blast radius to the LibreOffice process itself. Overall priority: medium-high for organisations where users routinely open legacy PPT files from untrusted sources.

An attacker sends a victim a crafted PPT file via email or a file-sharing link, engineered with a colour-replacement record whose combined colour entries across both parsing passes exceed the fixed stack table size. When the victim opens the file in LibreOffice, the PPT importer's second-pass processing writes colour data past the end of the stack-allocated tables, overwriting adjacent stack memory including saved return addresses or function pointers. Depending on platform stack protections and the attacker's ability to control the overflow content precisely, this results in application crash or controlled code execution under the victim's user account. A proof-of-concept exists (E:P), meaning the crash-triggering primitive has been demonstrated publicly.