TI-2026-05305 Aliases CVE-2026-6045 GHSA-mc63-87jp-8648

Heap buffer overflow in EMF+ gradient brush import

LOW 24CWE-190Published 2026-06-15 · Updated 2026-10-21

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · High
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and then filled as if it were large, writing past its end. In fixed versions the blend-point count is checked against the data actually available before allocating.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00208 10th percentileScored 2026-11-07

Fix Partial LibreOffice (The Document Foundation): < 25.8.7, < 26.2.3Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The Document Foundation	LibreOffice	25.8 to before < 25.8.7; 26.2 to before < 26.2.3	< 25.8.7, < 26.2.3	Patch available	CNA

LibreOffice VendorThe Document Foundation Affected 25.8 to before < 25.8.7; 26.2 to before < 26.2.3 Fixed in < 25.8.7, < 26.2.3 Patch available CNA

Remediation

Fix · CNA LibreOffice (The Document Foundation) Fixed in < 25.8.7, < 26.2.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-15
The Document Foundation LibreOffice < 25.8.7, < 26.2.3
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2026-05301 Heap use-after-free in ODF number-format blank-width parsingPriority LOW 24
- TI-2026-05300 Heap buffer overflow in DXF polyline importPriority LOW 24
- TI-2026-05307 Heap buffer overflow in OOXML text box element importPriority LOW 23
Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-6045
2026-10-03 Alias added: GHSA-mc63-87jp-8648

References

Other 1

https://www.libreoffice.org/about-us/security/advisories/cve-2026-6045

TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5

See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences