CVE-2026-6039

LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a polyline whose point count exceeded the 16-bit range was written past the end of the buffer. In fixed versions such oversized polylines are rejected.

CVSS

No CVSS.

References

Link	Resource
https://www.libreoffice.org/about-us/security/advisories/cve-2026-6039

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) LibreOffice puede importar dibujos en el formato DXF utilizado por el software CAD. Existía un desbordamiento de búfer en el heap al importar una polilínea DXF. El recuento de puntos tomado del archivo se truncaba a un valor de 16 bits cuando se dimensionaba el búfer de puntos, mientras que el recuento completo se utilizaba para llenarlo, por lo que una polilínea cuyo recuento de puntos excedía el rango de 16 bits se escribía más allá del final del búfer. En las versiones corregidas, dichas polilíneas sobredimensionadas son rechazadas.

Information

Published : 2026-06-15 18:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-6039

Mitre link : CVE-2026-6039

CVE.ORG link : CVE-2026-6039

JSON object : View

Products Affected

No product.

CWE

CWE-197

Numeric Truncation Error

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-6039", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6039", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T18:16:06.325169Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@documentfoundation.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@documentfoundation.org", "affectedData": [{"vendor": "The Document Foundation", "product": "LibreOffice", "versions": [{"status": "affected", "version": "25.8", "lessThan": "< 25.8.7", "versionType": "25.8 series"}, {"status": "affected", "version": "26.2", "lessThan": "< 26.2.3", "versionType": "26.2 series"}], "defaultStatus": "unknown"}]}], "published": "2026-06-15T18:16:36.740", "references": [{"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-6039", "source": "security@documentfoundation.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@documentfoundation.org", "description": [{"lang": "en", "value": "CWE-197"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a polyline whose point count exceeded the 16-bit range was written past the end of the buffer. In fixed versions such oversized polylines are rejected."}, {"lang": "es", "value": "LibreOffice puede importar dibujos en el formato DXF utilizado por el software CAD. Exist\u00eda un desbordamiento de b\u00fafer en el heap al importar una polil\u00ednea DXF. El recuento de puntos tomado del archivo se truncaba a un valor de 16 bits cuando se dimensionaba el b\u00fafer de puntos, mientras que el recuento completo se utilizaba para llenarlo, por lo que una polil\u00ednea cuyo recuento de puntos exced\u00eda el rango de 16 bits se escrib\u00eda m\u00e1s all\u00e1 del final del b\u00fafer. En las versiones corregidas, dichas polil\u00edneas sobredimensionadas son rechazadas."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security@documentfoundation.org"}