Read the docs
TI-2026-05301 Aliases CVE-2026-6040GHSA-pp4w-c8m6-4xvf

Heap use-after-free in ODF number-format blank-width parsing

Priority LOW 24CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00159 5th percentileScored 2026-11-07
Fix Partial LibreOffice (The Document Foundation): < 25.8.7, < 26.2.3Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The Document FoundationLibreOffice25.8 to before < 25.8.7; 26.2 to before < 26.2.3< 25.8.7, < 26.2.3Patch availableCNA
  • LibreOffice VendorThe Document Foundation Affected 25.8 to before < 25.8.7; 26.2 to before < 26.2.3 Fixed in < 25.8.7, < 26.2.3 Patch available CNA

Remediation

  • Fix · CNA LibreOffice (The Document Foundation) Fixed in < 25.8.7, < 26.2.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    The Document Foundation LibreOffice < 25.8.7, < 26.2.3

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-05305 Heap buffer overflow in EMF+ gradient brush importPriority LOW 24
    • TI-2026-05300 Heap buffer overflow in DXF polyline importPriority LOW 24
    • TI-2026-05307 Heap buffer overflow in OOXML text box element importPriority LOW 23
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6040
  2. 2026-10-03 Alias added: GHSA-pp4w-c8m6-4xvf

References

Other 1

  • TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
  • TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
  • TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
  • TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
  • TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
  • TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences