CVE-2026-6047

LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.

CVSS

No CVSS.

References

Link	Resource
https://www.libreoffice.org/about-us/security/advisories/cve-2026-6047

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) LibreOffice puede importar documentos en el formato OOXML (DOCX). Existía un desbordamiento de búfer en el montón al reproducir eventos de analizador diferidos para un elemento de cuadro de texto. Se asumía que un objeto gestor era de un tipo y se escribía en la disposición de campos de ese tipo, pero podía ser un objeto más pequeño, por lo que la escritura caía más allá del final de la asignación. En versiones corregidas, el tipo se verifica antes de la escritura.

Information

Published : 2026-06-15 18:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-6047

Mitre link : CVE-2026-6047

CVE.ORG link : CVE-2026-6047

JSON object : View

Products Affected

No product.

CWE

CWE-787

Out-of-bounds Write

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

{"id": "CVE-2026-6047", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6047", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T18:11:34.358602Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@documentfoundation.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@documentfoundation.org", "affectedData": [{"vendor": "The Document Foundation", "product": "LibreOffice", "versions": [{"status": "affected", "version": "25.8", "lessThan": "< 25.8.7", "versionType": "25.8 series"}, {"status": "affected", "version": "26.2", "lessThan": "< 26.2.3", "versionType": "26.2 series"}], "defaultStatus": "unknown"}]}], "published": "2026-06-15T18:16:37.127", "references": [{"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-6047", "source": "security@documentfoundation.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@documentfoundation.org", "description": [{"lang": "en", "value": "CWE-787"}, {"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write."}, {"lang": "es", "value": "LibreOffice puede importar documentos en el formato OOXML (DOCX). Exist\u00eda un desbordamiento de b\u00fafer en el mont\u00f3n al reproducir eventos de analizador diferidos para un elemento de cuadro de texto. Se asum\u00eda que un objeto gestor era de un tipo y se escrib\u00eda en la disposici\u00f3n de campos de ese tipo, pero pod\u00eda ser un objeto m\u00e1s peque\u00f1o, por lo que la escritura ca\u00eda m\u00e1s all\u00e1 del final de la asignaci\u00f3n. En versiones corregidas, el tipo se verifica antes de la escritura."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security@documentfoundation.org"}