Read the docs
TI-2026-85633 Aliases CVE-2026-76181GHSA-44mf-p26f-h973

Heap buffer overflow in LibreOffice dBASE index import

Priority LOW 23CWE-674Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-674.

Summary

LibreOffice from 26.2 before 26.2.6 and from 26.8 before 26.8.1 has a heap buffer overflow in its dBASE driver. The driver does not check the number of entries recorded in an index page against the number the page can hold (CWE-787). A crafted .ndx index can also make a page refer to itself, so reading it recurses without end. A local attacker can trigger this when a user opens a folder of dBASE files as a data source, and the flaw can disrupt availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00139 3rd percentileScored 2026-11-07
Fix Fixed LibreOffice (The Document Foundation): < 26.2.6, < 26.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The Document FoundationLibreOffice26.2 to before < 26.2.6; 26.8 to before < 26.8.1< 26.2.6, < 26.8.1Patch availableCNA
  • LibreOffice VendorThe Document Foundation Affected 26.2 to before < 26.2.6; 26.8 to before < 26.8.1 Fixed in < 26.2.6, < 26.8.1 Patch available CNA

Remediation

Update LibreOffice to 26.2.6 or later on the 26.2 branch and to 26.8.1 or later on the 26.8 branch.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA LibreOffice (The Document Foundation) Fixed in < 26.2.6, < 26.8.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-76181
  2. 2026-11-05 CVSS score added · CISA ADP
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: MEDIUM → LOW
  5. 2026-11-05 Alias added: GHSA-44mf-p26f-h973
  6. 2026-11-06 Affected versions changed · Red Hat
  7. 2026-11-06 CVSS score added · Red Hat
  8. 2026-11-06 Affected versions changed · Red Hat

References

Other 1

  • TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
  • TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
  • TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
  • TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
  • TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
  • TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences