LibreOffice EUVD-2026-84352

Requires the victim to open, in LibreOffice, a document or graphic that embeds a malicious WMF image containing a text record with its own character advance widths where the advance-value count is smaller than the text length. Exploitation is LIMITED by: local attack vector (AV:L) - the file must be delivered to and opened by the victim; mandatory user interaction (UI:P) - no drive-by/remote-unauthenticated path; and the crash-dominant impact profile (confidentiality/integrity Low, availability High), which bounds realistic outcomes to denial of service rather than reliable code execution. No special LibreOffice configuration is needed - WMF import is a default-enabled feature.

This is a low-real-priority memory-corruption bug despite a MEDIUM CVSS of 5.4. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H) is crash-dominant: only availability is High while confidentiality and integrity are Low, consistent with a heap out-of-bounds walk of an advance-width array that typically corrupts adjacent heap data and crashes rather than yielding attacker-controlled code execution. Exploitation is not remote-automatable - it is local (AV:L) and requires the victim to open a malicious file (UI:P/E:P is Proof-of-Concept maturity, not active exploitation). No EPSS score, no CISA KEV listing, and no public exploit are provided, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (local + user-interaction + crash-dominant impact = opportunistic, not wormable). One note: the CVSS 4.0 E:P (proof-of-concept exploit maturity) metric is present but no POC artifact is referenced in the single LibreOffice advisory - verify with vendor whether a POC actually exists, as this is the only weak divergence in the data.

An attacker crafts a document (or standalone WMF graphic) embedding a WMF text record whose declared count of character advance widths is smaller than the length of the text to be drawn, and delivers it to a victim (email attachment, download). When the victim opens the file in LibreOffice, rendering the text walks the advance array by character position and reads/writes past its end, corrupting the heap and typically crashing the application. No public exploit is identified; the vendor CVSS marks exploit maturity as proof-of-concept.