This vulnerability involves a heap use-after-free condition triggered during the import of blank-width characters in an ODF number format in LibreOffice. The root cause is a lack of validation on a position value against the length of the format-code string, which can lead to memory access outside the allocated string. The issue is addressed in fixed versions by adding bounds checking before using the position value. The CVSS 4.0 base score is 5.4, indicating medium severity, with local attack vector, low complexity, no privileges required, and partial impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The vendor advisory from Red Hat does not explicitly confirm patch availability or remediation status.

The vulnerability can lead to use-after-free memory corruption when processing malformed ODF number formats, potentially causing application crashes or other undefined behavior. The impact is rated medium severity with partial confidentiality, integrity, and availability impacts. There are no known exploits in the wild, and the attack requires local access with user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-6040 for current remediation guidance. The vulnerability is fixed in versions where bounds checking is implemented on the position value during ODF number format import. Until a patch is applied, avoid opening untrusted ODF documents that may contain malformed number formats.