Stack buffer overflow in PPT presentation import
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Document Foundation | LibreOffice | 26.2 to before < 26.2.4 | < 26.2.4 | Patch available | CNA |
- LibreOffice VendorThe Document Foundation Affected 26.2 to before < 26.2.4 Fixed in < 26.2.4 Patch available CNA
Remediation
- Fix · CNA LibreOffice (The Document Foundation) Fixed in < 26.2.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
The Document Foundation LibreOffice < 26.2.4
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-07351 Heap buffer overflow in Calc formula compilationPriority LOW 24
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-8356
- 2026-10-03 Alias added: GHSA-8r7p-3qw5-wxm5
More The Document Foundation vulnerabilities
- TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
- TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
- TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
- TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
- TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
- TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-8356 · CVE Program
- CVE-2026-8356 · NVD
- FIRST EPSS
- GHSA-8r7p-3qw5-wxm5 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-8356 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences