CVE-2026-8358

LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected.

CVSS

No CVSS.

References

Link	Resource
https://www.libreoffice.org/about-us/security/advisories/cve-2026-8358

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) LibreOffice Calc puede importar cambios registrados de un documento de hoja de cálculo. Existía un desbordamiento de búfer en el montón cuando un documento reutilizaba el mismo identificador de cambio para dos tipos de cambio diferentes. El importador entonces trataba un objeto de cambio como un tipo diferente y más grande y escribía más allá del final de su asignación. En versiones corregidas, los registros con un identificador duplicado son rechazados.

Information

Published : 2026-06-15 18:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-8358

Mitre link : CVE-2026-8358

CVE.ORG link : CVE-2026-8358

JSON object : View

Products Affected

No product.

CWE

CWE-787

Out-of-bounds Write

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

{"id": "CVE-2026-8358", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8358", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T18:01:43.169114Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@documentfoundation.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@documentfoundation.org", "affectedData": [{"vendor": "The Document Foundation", "product": "LibreOffice", "versions": [{"status": "affected", "version": "25.8", "lessThan": "< 25.8.7", "versionType": "26.2 series"}, {"status": "affected", "version": "26.2", "lessThan": "< 26.2.4", "versionType": "26.2 series"}], "defaultStatus": "unknown"}]}], "published": "2026-06-15T18:16:37.630", "references": [{"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-8358", "source": "security@documentfoundation.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@documentfoundation.org", "description": [{"lang": "en", "value": "CWE-787"}, {"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected."}, {"lang": "es", "value": "LibreOffice Calc puede importar cambios registrados de un documento de hoja de c\u00e1lculo. Exist\u00eda un desbordamiento de b\u00fafer en el mont\u00f3n cuando un documento reutilizaba el mismo identificador de cambio para dos tipos de cambio diferentes. El importador entonces trataba un objeto de cambio como un tipo diferente y m\u00e1s grande y escrib\u00eda m\u00e1s all\u00e1 del final de su asignaci\u00f3n. En versiones corregidas, los registros con un identificador duplicado son rechazados."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security@documentfoundation.org"}