CVE-2026-6047
Fixed in a distro release EPSS <1%CVSS 5.4
LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.
Products: The Document Foundation LibreOffice
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 14 | libreoffice | 4:26.2.3.2-2 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | libreoffice | 26.2.5.1-150500.20.37.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | libreoffice | 26.2.5.1-150500.20.37.1 |
| Ubuntu 26.04 LTS | libreoffice | 4:26.2.4.2-0ubuntu0.26.04.2 |