Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2026-6047

Heap buffer overflow in OOXML text box element import

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Document Fdn.

Description

LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

The Document Foundation LibreOffice

Default version status: unknown

  • 25.8 to < < 25.8.7affected
  • 26.2 to < < 26.2.3affected

References