CVE-2026-6047
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk2th percentile — higher than 2% of all known CVEs
Summary
LibreOffice has a heap buffer overflow vulnerability when replaying deferred parser events for a text box element in OOXML (DOCX) documents. The issue arises from assuming a handler object is of one type, leading to writes beyond the end of the allocation.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code, potentially taking control of the user's system. Organizations should be aware of the risks associated with opening malicious documents.
Recommendation
It is recommended to update LibreOffice to the latest version where security fixes have been implemented. Additionally, limit opening documents from unknown sources.
Original NVD description (English source)
LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.