A heap use-after-free flaw exists in Gnumeric when processing a malformed SheetObjectComponent element in a workbook. The XML parser dereferences a freed sheet-object component, causing a crash. This vulnerability has a CVSS 3.1 base score of 5.5 (medium severity) with local attack vector, low complexity, no privileges required, user interaction needed, and impacts availability only. Red Hat's advisory confirms no impact on supported Red Hat products and recommends avoiding untrusted files. No patch or fix is currently referenced in the advisory.

The vulnerability causes a denial of service by crashing Gnumeric when opening a specially crafted workbook. There is no direct impact on confidentiality or integrity reported. While use-after-free vulnerabilities can sometimes lead to arbitrary code execution, no such exploitation is confirmed or documented here. The flaw affects availability by causing application crashes.

Avoid opening Gnumeric workbook files from untrusted sources. There is no known application-level mitigation that allows safe processing of untrusted workbooks. Monitor vendor advisories for any future patches or updates.