CVE-2026-8357: CWE-787 Out-of-bounds Write in The Document Foundation LibreOffice
LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.
AI Analysis
Technical Summary
LibreOffice Calc compiles cell formulas when opening spreadsheets. A heap buffer overflow vulnerability exists due to an off-by-one error in the allocation of the array that tracks formula nesting depth. When compiling a very long formula with many opening tokens, the array is one element too small, leading to an out-of-bounds write past the array's end. This vulnerability (CWE-787) can result in arbitrary code execution. Red Hat has issued a security advisory and patch for affected LibreOffice packages in Red Hat Enterprise Linux 7 Extended Life Cycle Support. The vulnerability has a CVSS 4.0 base score of 5.4 (medium severity).
Potential Impact
The vulnerability allows an attacker to cause a heap buffer overflow when processing specially crafted spreadsheet formulas, potentially leading to arbitrary code execution with the privileges of the user running LibreOffice Calc. This can compromise system integrity and confidentiality. No known exploits are currently reported in the wild.
Mitigation Recommendations
A security update fixing this vulnerability is available from Red Hat for LibreOffice packages in Red Hat Enterprise Linux 7 Extended Life Cycle Support. Users should apply the official Red Hat patch as described in the advisory at https://access.redhat.com/articles/11258. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.
CVE-2026-8357: CWE-787 Out-of-bounds Write in The Document Foundation LibreOffice
Description
LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.
CVSS v4.0
Score 5.4medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
LibreOffice Calc compiles cell formulas when opening spreadsheets. A heap buffer overflow vulnerability exists due to an off-by-one error in the allocation of the array that tracks formula nesting depth. When compiling a very long formula with many opening tokens, the array is one element too small, leading to an out-of-bounds write past the array's end. This vulnerability (CWE-787) can result in arbitrary code execution. Red Hat has issued a security advisory and patch for affected LibreOffice packages in Red Hat Enterprise Linux 7 Extended Life Cycle Support. The vulnerability has a CVSS 4.0 base score of 5.4 (medium severity).
Potential Impact
The vulnerability allows an attacker to cause a heap buffer overflow when processing specially crafted spreadsheet formulas, potentially leading to arbitrary code execution with the privileges of the user running LibreOffice Calc. This can compromise system integrity and confidentiality. No known exploits are currently reported in the wild.
Mitigation Recommendations
A security update fixing this vulnerability is available from Red Hat for LibreOffice packages in Red Hat Enterprise Linux 7 Extended Life Cycle Support. Users should apply the official Red Hat patch as described in the advisory at https://access.redhat.com/articles/11258. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Document Fdn.
- Date Reserved
- 2026-05-11T18:55:27.138Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-8357","vendor":"Red Hat"}]
Threat ID: 6a303db60b89be6888695b28
Added to database: 06/15/2026, 18:00:22 UTC
Last enriched: 07/30/2026, 22:16:57 UTC
Last updated: 07/31/2026, 19:30:16 UTC
Views: 300
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.