CVE-2026-6045
Fixed in a distro release EPSS <1%CVSS 5.4
LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and then filled as if it were large, writing past its end. In fixed versions the blend-point count is checked against the data actually available before allocating.
Products: The Document Foundation LibreOffice
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | libreoffice | 4:7.4.7-1+deb12u13 |
| Debian:13 | libreoffice | 4:25.2.3-2+deb13u5 |
| Debian:14 | libreoffice | 4:26.2.3.2-2 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | libreoffice | 26.2.5.1-150500.20.37.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | libreoffice | 26.2.5.1-150500.20.37.1 |
| Ubuntu:20.04:LTS | libreoffice | no fix |
| Ubuntu:22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.12 |
| Ubuntu:24.04:LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.6 |
| Ubuntu:25.10 | libreoffice | no fix |
| Ubuntu:26.04:LTS | libreoffice | 4:26.2.4.2-0ubuntu0.26.04.2 |