Gnumeric EUVD-2026-87095

Exploitation requires the victim to open an attacker-supplied Gnumeric workbook file that contains a malformed SheetObjectComponent XML element; the flaw is triggered during XML parsing of that element by Gnumeric. Limiting factors: attack is local (AV:L) and requires user interaction (UI:R) - the victim must actively open the crafted file; there is no remote or unauthenticated network vector, and impact is confined to a crash (no confidentiality or integrity loss). This is not exploitable against default configurations without delivering and having the user open a malicious file.

This is a genuinely medium-severity availability-only issue, not a hidden critical. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: exploitation requires a victim to locally open a crafted Gnumeric workbook (AV:L + UI:R), and the sole impact is a heap use-after-free that crashes the application (A:H, with C:N/I:N). CWE-416 use-after-free can sometimes escalate to code execution, but the description explicitly limits the outcome to 'causing Gnumeric to crash,' so treating this as denial-of-service only is appropriate absent evidence of a controllable write. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so exploitation status is 'no public exploit identified at time of analysis.' Net: low real-world urgency - a client-side crash in a niche desktop spreadsheet app that needs user interaction and yields no confidentiality/integrity impact. There is no conflict between the CVSS vector and the description; both point to a local, user-interaction-gated crash.

An attacker crafts a malicious .gnumeric workbook containing a malformed SheetObjectComponent XML element and delivers it to a victim (email attachment, download, shared drive). When the victim opens the file in Gnumeric, the XML parser dereferences a freed sheet-object component, triggering the use-after-free and crashing the application. No public exploit code is known, and the described impact is limited to a crash rather than code execution.