Heap-based buffer overflow in LibreOffice - CVE-2026-8357

Vulnerability identifier: #VU134743

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-8357

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Calc formula compilation when parsing a specially crafted document containing a very long formula with many opening tokens. A remote attacker can trick the victim into opening a crafted document to execute arbitrary code.

User interaction is required to open a crafted document.

LibreOffice
Debian Linux
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Ubuntu
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libreoffice (Red Hat package)
libreoffice-langpack-ve
libreoffice-langpack-ss
libreoffice-langpack-st
libreoffice-langpack-sv
libreoffice-langpack-ta
libreoffice-langpack-te
libreoffice-langpack-th
libreoffice-langpack-tn
libreoffice-langpack-tr
libreoffice-langpack-ts
libreoffice-langpack-uk
libreoffice-langpack-sr
libreoffice-langpack-xh
libreoffice-langpack-zh-Hans
libreoffice-langpack-zh-Hant
libreoffice-langpack-zu
libreoffice-math
libreoffice-nlpsolver
libreoffice-ogltrans
libreoffice-pdfimport
libreoffice-pyuno
libreoffice-sdk
libreoffice-langpack-nso
libreoffice-langpack-ko
libreoffice-langpack-lt
libreoffice-langpack-lv
libreoffice-langpack-mai
libreoffice-langpack-ml
libreoffice-langpack-mr
libreoffice-langpack-nb
libreoffice-langpack-nl
libreoffice-langpack-nn
libreoffice-langpack-nr
libreoffice-sdk-doc
libreoffice-langpack-or
libreoffice-langpack-pa
libreoffice-langpack-pl
libreoffice-langpack-pt-BR
libreoffice-langpack-pt-PT
libreoffice-langpack-ro
libreoffice-langpack-ru
libreoffice-langpack-si
libreoffice-langpack-sk
libreoffice-langpack-sl
autocorr-ru
autocorr-it
autocorr-ja
autocorr-ko
autocorr-lb
autocorr-lt
autocorr-mn
autocorr-nl
autocorr-pl
autocorr-pt
autocorr-ro
autocorr-is
autocorr-sk
autocorr-sl
autocorr-sr
autocorr-sv
autocorr-tr
autocorr-vi
autocorr-zh
libreoffice-data
libreoffice-opensymbol-fonts
libreoffice-ure-common
autocorr-da
libreoffice-ure
libreoffice-wiki-publisher
libreoffice-writer
libreoffice-x11
libreoffice-xsltfilter
libreofficekit
autocorr-af
autocorr-bg
autocorr-ca
autocorr-cs
libreoffice
autocorr-de
autocorr-el
autocorr-en
autocorr-es
autocorr-fa
autocorr-fi
autocorr-fr
autocorr-ga
autocorr-hr
autocorr-hu
libreoffice-help-it
libreoffice-help-eu
libreoffice-help-fi
libreoffice-help-fr
libreoffice-help-gl
libreoffice-help-gu
libreoffice-help-he
libreoffice-help-hi
libreoffice-help-hr
libreoffice-help-hu
libreoffice-help-id
libreoffice-help-et
libreoffice-help-ja
libreoffice-help-ko
libreoffice-help-lt
libreoffice-help-lv
libreoffice-help-nb
libreoffice-help-nl
libreoffice-help-nn
libreoffice-help-pl
libreoffice-help-pt-BR
libreoffice-help-pt-PT
libreoffice-help-bg
libreoffice-base
libreoffice-calc
libreoffice-core
libreoffice-draw
libreoffice-emailmerge
libreoffice-filters
libreoffice-gdb-debug-support
libreoffice-graphicfilter
libreoffice-gtk3
libreoffice-help-ar
libreoffice-langpack-kk
libreoffice-help-bn
libreoffice-help-ca
libreoffice-help-cs
libreoffice-help-da
libreoffice-help-de
libreoffice-help-dz
libreoffice-help-el
libreoffice-help-en
libreoffice-help-es
libreoffice-langpack-ga
libreoffice-langpack-de
libreoffice-langpack-dz
libreoffice-langpack-el
libreoffice-langpack-en
libreoffice-langpack-es
libreoffice-langpack-et
libreoffice-langpack-eu
libreoffice-langpack-fa
libreoffice-langpack-fi
libreoffice-langpack-fr
libreoffice-help-ru
libreoffice-langpack-gl
libreoffice-langpack-gu
libreoffice-langpack-he
libreoffice-langpack-hi
libreoffice-langpack-hr
libreoffice-langpack-hu
libreoffice-langpack-id
libreoffice-langpack-it
libreoffice-langpack-ja
libreoffice-langpack-kn
libreoffice-langpack-cy
libreoffice-help-ro
libreoffice-help-si
libreoffice-help-sk
libreoffice-help-sl
libreoffice-help-sv
libreoffice-help-ta
libreoffice-help-tr
libreoffice-help-uk
libreoffice-help-zh-Hans
libreoffice-help-zh-Hant
libreoffice-impress
libreoffice-langpack-af
libreoffice-langpack-ar
libreoffice-langpack-as
libreoffice-langpack-bg
libreoffice-langpack-bn
libreoffice-langpack-br
libreoffice-langpack-ca
libreoffice-langpack-cs
libreoffice-langpack-da
libreoffice (Ubuntu package)
libreoffice (Debian package)

Install security update from vendor's website.

LibreOffice - update to 26.2.4.1
libreoffice (Red Hat package) - addressed in versions 6.4.7.2-18.el8_6.2, 7.1.8.1-15.el9_4.2, 7.1.8.1-15.el9_6.2, 7.1.8.1-15.el9_8.2
libreoffice-langpack-ve - update to 7.1.8.1-15.0.1
libreoffice-langpack-ss - update to 7.1.8.1-15.0.1
libreoffice-langpack-st - update to 7.1.8.1-15.0.1
libreoffice-langpack-sv - update to 7.1.8.1-15.0.1
libreoffice-langpack-ta - update to 7.1.8.1-15.0.1
libreoffice-langpack-te - update to 7.1.8.1-15.0.1
libreoffice-langpack-th - update to 7.1.8.1-15.0.1
libreoffice-langpack-tn - update to 7.1.8.1-15.0.1
libreoffice-langpack-tr - update to 7.1.8.1-15.0.1
libreoffice-langpack-ts - update to 7.1.8.1-15.0.1
libreoffice-langpack-uk - update to 7.1.8.1-15.0.1
libreoffice-langpack-sr - update to 7.1.8.1-15.0.1
libreoffice-langpack-xh - update to 7.1.8.1-15.0.1
libreoffice-langpack-zh-Hans - update to 7.1.8.1-15.0.1
libreoffice-langpack-zh-Hant - update to 7.1.8.1-15.0.1
libreoffice-langpack-zu - update to 7.1.8.1-15.0.1
libreoffice-math - update to 7.1.8.1-15.0.1
libreoffice-nlpsolver - update to 7.1.8.1-15.0.1
libreoffice-ogltrans - update to 7.1.8.1-15.0.1
libreoffice-pdfimport - update to 7.1.8.1-15.0.1
libreoffice-pyuno - update to 7.1.8.1-15.0.1
libreoffice-sdk - update to 7.1.8.1-15.0.1
libreoffice-langpack-nso - update to 7.1.8.1-15.0.1
libreoffice-langpack-ko - update to 7.1.8.1-15.0.1
libreoffice-langpack-lt - update to 7.1.8.1-15.0.1
libreoffice-langpack-lv - update to 7.1.8.1-15.0.1
libreoffice-langpack-mai - update to 7.1.8.1-15.0.1
libreoffice-langpack-ml - update to 7.1.8.1-15.0.1
libreoffice-langpack-mr - update to 7.1.8.1-15.0.1
libreoffice-langpack-nb - update to 7.1.8.1-15.0.1
libreoffice-langpack-nl - update to 7.1.8.1-15.0.1
libreoffice-langpack-nn - update to 7.1.8.1-15.0.1
libreoffice-langpack-nr - update to 7.1.8.1-15.0.1
libreoffice-sdk-doc - update to 7.1.8.1-15.0.1
libreoffice-langpack-or - update to 7.1.8.1-15.0.1
libreoffice-langpack-pa - update to 7.1.8.1-15.0.1
libreoffice-langpack-pl - update to 7.1.8.1-15.0.1
libreoffice-langpack-pt-BR - update to 7.1.8.1-15.0.1
libreoffice-langpack-pt-PT - update to 7.1.8.1-15.0.1
libreoffice-langpack-ro - update to 7.1.8.1-15.0.1
libreoffice-langpack-ru - update to 7.1.8.1-15.0.1
libreoffice-langpack-si - update to 7.1.8.1-15.0.1
libreoffice-langpack-sk - update to 7.1.8.1-15.0.1
libreoffice-langpack-sl - update to 7.1.8.1-15.0.1
autocorr-ru - update to 7.1.8.1-15.0.1
autocorr-it - update to 7.1.8.1-15.0.1
autocorr-ja - update to 7.1.8.1-15.0.1
autocorr-ko - update to 7.1.8.1-15.0.1
autocorr-lb - update to 7.1.8.1-15.0.1
autocorr-lt - update to 7.1.8.1-15.0.1
autocorr-mn - update to 7.1.8.1-15.0.1
autocorr-nl - update to 7.1.8.1-15.0.1
autocorr-pl - update to 7.1.8.1-15.0.1
autocorr-pt - update to 7.1.8.1-15.0.1
autocorr-ro - update to 7.1.8.1-15.0.1
autocorr-is - update to 7.1.8.1-15.0.1
autocorr-sk - update to 7.1.8.1-15.0.1
autocorr-sl - update to 7.1.8.1-15.0.1
autocorr-sr - update to 7.1.8.1-15.0.1
autocorr-sv - update to 7.1.8.1-15.0.1
autocorr-tr - update to 7.1.8.1-15.0.1
autocorr-vi - update to 7.1.8.1-15.0.1
autocorr-zh - update to 7.1.8.1-15.0.1
libreoffice-data - update to 7.1.8.1-15.0.1
libreoffice-opensymbol-fonts - update to 7.1.8.1-15.0.1
libreoffice-ure-common - update to 7.1.8.1-15.0.1
autocorr-da - update to 7.1.8.1-15.0.1
libreoffice-ure - update to 7.1.8.1-15.0.1
libreoffice-wiki-publisher - update to 7.1.8.1-15.0.1
libreoffice-writer - update to 7.1.8.1-15.0.1
libreoffice-x11 - update to 7.1.8.1-15.0.1
libreoffice-xsltfilter - update to 7.1.8.1-15.0.1
libreofficekit - update to 7.1.8.1-15.0.1
autocorr-af - update to 7.1.8.1-15.0.1
autocorr-bg - update to 7.1.8.1-15.0.1
autocorr-ca - update to 7.1.8.1-15.0.1
autocorr-cs - update to 7.1.8.1-15.0.1
libreoffice - update to 7.1.8.1-15.0.1
autocorr-de - update to 7.1.8.1-15.0.1
autocorr-el - update to 7.1.8.1-15.0.1
autocorr-en - update to 7.1.8.1-15.0.1
autocorr-es - update to 7.1.8.1-15.0.1
autocorr-fa - update to 7.1.8.1-15.0.1
autocorr-fi - update to 7.1.8.1-15.0.1
autocorr-fr - update to 7.1.8.1-15.0.1
autocorr-ga - update to 7.1.8.1-15.0.1
autocorr-hr - update to 7.1.8.1-15.0.1
autocorr-hu - update to 7.1.8.1-15.0.1
libreoffice-help-it - update to 7.1.8.1-15.0.1
libreoffice-help-eu - update to 7.1.8.1-15.0.1
libreoffice-help-fi - update to 7.1.8.1-15.0.1
libreoffice-help-fr - update to 7.1.8.1-15.0.1
libreoffice-help-gl - update to 7.1.8.1-15.0.1
libreoffice-help-gu - update to 7.1.8.1-15.0.1
libreoffice-help-he - update to 7.1.8.1-15.0.1
libreoffice-help-hi - update to 7.1.8.1-15.0.1
libreoffice-help-hr - update to 7.1.8.1-15.0.1
libreoffice-help-hu - update to 7.1.8.1-15.0.1
libreoffice-help-id - update to 7.1.8.1-15.0.1
libreoffice-help-et - update to 7.1.8.1-15.0.1
libreoffice-help-ja - update to 7.1.8.1-15.0.1
libreoffice-help-ko - update to 7.1.8.1-15.0.1
libreoffice-help-lt - update to 7.1.8.1-15.0.1
libreoffice-help-lv - update to 7.1.8.1-15.0.1
libreoffice-help-nb - update to 7.1.8.1-15.0.1
libreoffice-help-nl - update to 7.1.8.1-15.0.1
libreoffice-help-nn - update to 7.1.8.1-15.0.1
libreoffice-help-pl - update to 7.1.8.1-15.0.1
libreoffice-help-pt-BR - update to 7.1.8.1-15.0.1
libreoffice-help-pt-PT - update to 7.1.8.1-15.0.1
libreoffice-help-bg - update to 7.1.8.1-15.0.1
libreoffice-base - update to 7.1.8.1-15.0.1
libreoffice-calc - update to 7.1.8.1-15.0.1
libreoffice-core - update to 7.1.8.1-15.0.1
libreoffice-draw - update to 7.1.8.1-15.0.1
libreoffice-emailmerge - update to 7.1.8.1-15.0.1
libreoffice-filters - update to 7.1.8.1-15.0.1
libreoffice-gdb-debug-support - update to 7.1.8.1-15.0.1
libreoffice-graphicfilter - update to 7.1.8.1-15.0.1
libreoffice-gtk3 - update to 7.1.8.1-15.0.1
libreoffice-help-ar - update to 7.1.8.1-15.0.1
libreoffice-langpack-kk - update to 7.1.8.1-15.0.1
libreoffice-help-bn - update to 7.1.8.1-15.0.1
libreoffice-help-ca - update to 7.1.8.1-15.0.1
libreoffice-help-cs - update to 7.1.8.1-15.0.1
libreoffice-help-da - update to 7.1.8.1-15.0.1
libreoffice-help-de - update to 7.1.8.1-15.0.1
libreoffice-help-dz - update to 7.1.8.1-15.0.1
libreoffice-help-el - update to 7.1.8.1-15.0.1
libreoffice-help-en - update to 7.1.8.1-15.0.1
libreoffice-help-es - update to 7.1.8.1-15.0.1
libreoffice-langpack-ga - update to 7.1.8.1-15.0.1
libreoffice-langpack-de - update to 7.1.8.1-15.0.1
libreoffice-langpack-dz - update to 7.1.8.1-15.0.1
libreoffice-langpack-el - update to 7.1.8.1-15.0.1
libreoffice-langpack-en - update to 7.1.8.1-15.0.1
libreoffice-langpack-es - update to 7.1.8.1-15.0.1
libreoffice-langpack-et - update to 7.1.8.1-15.0.1
libreoffice-langpack-eu - update to 7.1.8.1-15.0.1
libreoffice-langpack-fa - update to 7.1.8.1-15.0.1
libreoffice-langpack-fi - update to 7.1.8.1-15.0.1
libreoffice-langpack-fr - update to 7.1.8.1-15.0.1
libreoffice-help-ru - update to 7.1.8.1-15.0.1
libreoffice-langpack-gl - update to 7.1.8.1-15.0.1
libreoffice-langpack-gu - update to 7.1.8.1-15.0.1
libreoffice-langpack-he - update to 7.1.8.1-15.0.1
libreoffice-langpack-hi - update to 7.1.8.1-15.0.1
libreoffice-langpack-hr - update to 7.1.8.1-15.0.1
libreoffice-langpack-hu - update to 7.1.8.1-15.0.1
libreoffice-langpack-id - update to 7.1.8.1-15.0.1
libreoffice-langpack-it - update to 7.1.8.1-15.0.1
libreoffice-langpack-ja - update to 7.1.8.1-15.0.1
libreoffice-langpack-kn - update to 7.1.8.1-15.0.1
libreoffice-langpack-cy - update to 7.1.8.1-15.0.1
libreoffice-help-ro - update to 7.1.8.1-15.0.1
libreoffice-help-si - update to 7.1.8.1-15.0.1
libreoffice-help-sk - update to 7.1.8.1-15.0.1
libreoffice-help-sl - update to 7.1.8.1-15.0.1
libreoffice-help-sv - update to 7.1.8.1-15.0.1
libreoffice-help-ta - update to 7.1.8.1-15.0.1
libreoffice-help-tr - update to 7.1.8.1-15.0.1
libreoffice-help-uk - update to 7.1.8.1-15.0.1
libreoffice-help-zh-Hans - update to 7.1.8.1-15.0.1
libreoffice-help-zh-Hant - update to 7.1.8.1-15.0.1
libreoffice-impress - update to 7.1.8.1-15.0.1
libreoffice-langpack-af - update to 7.1.8.1-15.0.1
libreoffice-langpack-ar - update to 7.1.8.1-15.0.1
libreoffice-langpack-as - update to 7.1.8.1-15.0.1
libreoffice-langpack-bg - update to 7.1.8.1-15.0.1
libreoffice-langpack-bn - update to 7.1.8.1-15.0.1
libreoffice-langpack-br - update to 7.1.8.1-15.0.1
libreoffice-langpack-ca - update to 7.1.8.1-15.0.1
libreoffice-langpack-cs - update to 7.1.8.1-15.0.1
libreoffice-langpack-da - update to 7.1.8.1-15.0.1
libreoffice (Ubuntu package) - addressed in versions 1:7.3.7-0ubuntu0.22.04.12, 4:24.2.7-0ubuntu0.24.04.6, 4:26.2.4.2-0ubuntu0.26.04.2
libreoffice (Debian package) - update to 4:25.2.3-2+deb13u5

• https://www.libreoffice.org/security/#cve-2026-8357

• Multiple vulnerabilities in LibreOffice
• Debian update for libreoffice
• Red Hat Enterprise Linux 9 update for libreoffice
• Ubuntu update for libreoffice
• Anolis OS update for libreoffice
• Red Hat Enterprise Linux 9 update for libreoffice
• Red Hat Enterprise Linux 9 update for libreoffice
• Red Hat Enterprise Linux 8 update for libreoffice