LibreOffice EUVD-2026-84358

Exploitation requires a victim to open, in LibreOffice, a document or image that embeds a crafted PICT image using a colour palette whose stored palette index exceeds the number of palette entries. Limiting factors: the attack is local file-open only (AV:L) and needs passive user interaction (UI:P) to trigger the vulnerable PICT import path; no authentication or special non-default configuration is required since PICT import is a standard supported feature. Practical impact is bounded to a likely application crash (VA:H) with only minor potential memory disclosure (VC:L).

This is a moderate-severity, DoS-oriented client-side memory-safety bug, not a high-priority remotely-exploitable flaw. The vendor CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:P/VC:L/VI:N/VA:H, base 5.4) is internally consistent with the description: exploitation requires a victim to open a crafted document locally (AV:L + UI:P passive interaction), and the dominant impact is availability (VA:H, i.e. a crash from the out-of-bounds read) with only a low confidentiality impact (VC:L) - appropriate because an OOB read past a colour palette rarely returns attacker-usable data back to the user. The threat metric E:P indicates proof-of-concept exploit maturity per the vendor, so treat exploit code as 'PoC-level exists' rather than active exploitation. There is no EPSS score, no CISA KEV listing, and no standalone public PoC referenced beyond the vendor advisory, so this is not confirmed actively exploited. Conflict to note: the input header lists a CVSS 3.1-style score of 5.4 but the actual vector supplied is CVSS 4.0 - the '5.4' is the 4.0 base, and no CVSS 3.1 vector was provided by the source. Net: real but low-urgency; patch during normal cycles, prioritize environments that auto-render untrusted documents.

An attacker crafts a document (or standalone PICT image) containing an embedded palette-based PICT image whose stored palette index exceeds the palette's entry count, then delivers it via email or download. When a victim opens the file in an unpatched LibreOffice, the import code reads memory outside the palette, most likely crashing the application (denial of service) and potentially exposing a small amount of adjacent process memory. The vendor threat metric indicates proof-of-concept-level exploit maturity, but no weaponized in-the-wild exploitation is confirmed.