Heap-based buffer overflow in LibreOffice - CVE-2026-6039
Published: June 17, 2026
Vulnerability identifier: #VU134746
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-6039
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in DXF polyline import when parsing a crafted DXF file. A remote attacker can trick the victim into opening a specially crafted file to execute arbitrary code.
The issue occurs when a polyline point count exceeds the 16-bit range, causing the buffer to be sized using a truncated value while writes use the full count.
Affected software
LibreOffice
Debian Linux
Ubuntu
libreoffice (Ubuntu package)
libreoffice (Debian package)
Debian Linux
Ubuntu
libreoffice (Ubuntu package)
libreoffice (Debian package)
How to mitigate CVE-2026-6039
Install security update from vendor's website.
LibreOffice - update to 26.2.4.1
libreoffice (Ubuntu package) - addressed in versions 1:7.3.7-0ubuntu0.22.04.12, 4:24.2.7-0ubuntu0.24.04.6, 4:26.2.4.2-0ubuntu0.26.04.2
libreoffice (Debian package) - update to 4:25.2.3-2+deb13u5
libreoffice (Ubuntu package) - addressed in versions 1:7.3.7-0ubuntu0.22.04.12, 4:24.2.7-0ubuntu0.24.04.6, 4:26.2.4.2-0ubuntu0.26.04.2
libreoffice (Debian package) - update to 4:25.2.3-2+deb13u5