EUVD-2026-36739
GHSA-j779-pcc6-8c5f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft spreadsheet with max-depth nested formula
-
DeliveryDeliver file via phishing or malicious download
-
ExploitVictim opens file in LibreOffice Calc
-
ExecutionFormula compiler allocates undersized nesting-depth array
-
PersistOff-by-one write corrupts adjacent heap memory
-
ImpactApplication crash (DoS) or heap metadata corruption enabling code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The triggering condition is opening a LibreOffice Calc-compatible spreadsheet file (e.g., .ods, .xlsx, .xls) that contains a cell formula with nesting depth at or exceeding the maximum nesting depth the compiler supports. No special LibreOffice configuration is required - formula compilation is always active when Calc opens a spreadsheet. No authentication to the system is needed (PR:N), and no elevated privileges are required. Exploitation is limited by the mandatory passive user interaction (UI:P): the victim must open the malicious file. Additionally, the off-by-one nature of the overflow means only a single heap element is written out of bounds, making reliable code execution dependent on favorable heap layout; crash/DoS is the most reproducible outcome. There is no indication that specific operating system, locale, or feature flag is required beyond a standard LibreOffice Calc installation. |
| Impact | The CVSS 4.0 score of 5.4 (AV:L/AC:L/AT:N/PR:N/UI:P) reflects a moderate real-world risk profile. The local attack vector (AV:L) constrains the threat to file-delivery scenarios - the attacker cannot reach this code path remotely without user interaction. UI:P confirms passive user interaction is required (opening the file), which is a meaningful constraint but highly achievable via phishing or malicious document delivery. The E:P modifier in the provided CVSS 4.0 vector confirms a proof-of-concept exists, elevating the urgency modestly. No KEV listing indicates no confirmed active exploitation in the wild at time of analysis. The off-by-one nature of the overflow (exactly one element past the end) typically limits reliability: while heap metadata corruption is possible, consistent exploitation for arbitrary code execution is non-trivial and depends heavily on heap layout at runtime. The VA:H impact rating reflects reliable application crash/DoS as the most achievable outcome; VC:L and VI:L suggest bounded but non-zero potential for memory disclosure or limited corruption. On balance, this is a genuine patch priority for organizations deploying LibreOffice in environments where untrusted spreadsheets may be opened, but it is not a critical emergency absent KEV confirmation. |
| Exploit ScenarioDerived | An attacker crafts a malicious .ods or .xlsx spreadsheet file containing a single cell formula constructed with the maximum possible depth of opening tokens (e.g., deeply nested function calls or parentheses). The attacker delivers this file via email, a download link, or a shared document platform. When the victim opens the file in LibreOffice Calc, the formula compiler allocates the nesting-depth array one element too small and writes one element past its end, corrupting adjacent heap memory - most likely resulting in an application crash, and potentially enabling controlled heap corruption if the attacker can influence allocator layout. A proof-of-concept demonstrating the crash exists per the E:P CVSS 4.0 modifier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Heap buffer overflow in LibreOffice Calc's formula compiler allows an attacker to trigger an out-of-bounds write by crafting a spreadsheet containing a formula with extreme nesting depth composed of many consecutive opening tokens. The vulnerability stems from an off-by-one allocation error in the nesting-depth tracking array, causing a single-element write past the buffer's end during file parsing. The CVSS 4.0 vector carries an E:P modifier indicating a proof-of-concept exists; no public exploit identified at time of analysis beyond the POC, and the vulnerability is not listed in CISA KEV.
RemediationAI
The primary remediation is to upgrade to the fixed version of LibreOffice as identified in the vendor advisory at https://www.libreoffice.org/about-us/security/advisories/cve-2026-8357. The Document Foundation has corrected the nesting-depth array allocation to hold the largest possible nesting value; the exact fixed version number is not independently confirmed from the provided data and should be verified against the advisory before deployment. As a compensating control where immediate patching is not feasible, organizations can restrict LibreOffice from opening untrusted spreadsheet files by enforcing document-source policies (e.g., disabling macro execution and file-opening from untrusted origins via group policy or LibreOffice's security settings under Tools > Options > LibreOffice > Security). Note that disabling macro-related settings does not prevent formula compilation, so this control reduces attack surface only partially. Sandboxing LibreOffice via application-level isolation (e.g., AppArmor, Flatpak confinement, or running in a disposable container) limits the blast radius of exploitation to the sandboxed process. Upstream fix is confirmed by the vendor; patch version not independently verified from available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LibreOffice Calc's internal formula compiler performs eager compilation of cell formulas at spreadsheet load time. During parsing, it maintains an array to track nesting depth as it descends into nested formula structures (parentheses, function argument nesting, etc.). The affected code path (CWE-787: Out-of-bounds Write) allocated this nesting-depth array with a capacity of one element fewer than the maximum nesting depth the parser could legally reach, creating an off-by-one heap buffer overflow condition. When a crafted formula exercises that worst-case nesting depth, the compiler writes exactly one element beyond the end of the allocated heap buffer. The affected product is identified via CPE cpe:2.3:a:the_document_foundation:libreoffice:*:*:*:*:*:*:*:*, indicating the issue applies across the LibreOffice suite broadly, with Calc as the affected component. The fix corrects the allocation to accommodate the true maximum nesting value.
Know when Libreoffice gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P
File-based delivery is AV:L/UI:R; no privileges needed (PR:N); off-by-one heap write yields high availability impact with limited confidentiality and integrity exposure.
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Primary rating from Vendor (Document Fdn.).
CVSS VectorVendor: Document Fdn.
Lifecycle Timeline
2DescriptionCVE.org
LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Libreoffice
View allLibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitra
Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load p
LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a deni
LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a
In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist
Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and
An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically p
Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified
Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denia
LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possib
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x
LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::Imp
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP5 | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Desktop 15 SP5 | Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP5 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB