LibreOffice Calc EUVD-2026-36740

Exploitation requires the victim to open a crafted spreadsheet document that contains a tracked-changes section with at least two records sharing the same change identifier but representing different change types - a malformed condition that does not arise in legitimately generated documents. Passive user interaction is mandatory (CVSS 4.0 UI:P): the targeted individual must be persuaded to open the file, making social engineering the primary delivery prerequisite. No attacker authentication or privilege is required (PR:N). The vulnerability is constrained to the tracked-changes import code path in LibreOffice Calc; documents without tracked changes or with validly formed change records are not affected. Exploitation does not propagate automatically across a network and cannot be triggered remotely without user action. Scope is limited to the vulnerable system with no lateral impact on subsequent systems (SC:N/SI:N/SA:N).

The CVSS 4.0 base score of 5.4 (Medium) reflects a local attack vector (AV:L), passive user interaction (UI:P), no required privileges (PR:N), high availability impact (VA:H), and low confidentiality and integrity impact (VC:L/VI:L). The E:P threat modifier confirms proof-of-concept exploit code exists, elevating practical risk above the base score alone - defenders should treat this as more accessible than a theoretical flaw. The attack vector being local in CVSS 4.0 terminology for a file-parsing bug means the malicious file must be processed on the local system, consistent with a user opening a delivered document; this does not imply the attacker needs physical access. No EPSS score was provided, and the absence of a KEV listing means mass exploitation is not confirmed, but the existence of a POC and a realistic delivery vector (phishing, malicious email attachment) makes targeted exploitation feasible. The high availability impact is well-supported by the heap overflow description; the low confidentiality and integrity impacts suggest that reliable memory-read or precise write primitives may not be straightforwardly achievable, though heap corruption can escalate to code execution with a refined exploit. The Medium CVSS score should not be used to de-prioritize patching in environments where users routinely open spreadsheet documents from untrusted sources.

An attacker crafts a malicious LibreOffice Calc spreadsheet - in .ods or a compatible format - where the tracked-changes section assigns the same change identifier to two structurally different change record types, then delivers it via phishing email or a malicious download link. When the target user opens the file, the Calc importer processes the duplicate identifier, treats one change object as the larger type, and overwrites heap memory adjacent to the allocation; with a proof-of-concept already publicly available (E:P), a moderately skilled attacker could refine this overflow into arbitrary code execution running at the victim's user privilege level.