CVE-2026-8356: the document foundation libreoffice Stack-based Buffer Overflow
Vulnerability summary
CVE-2026-8356 is a medium (CVSS 5.4) Stack-based Buffer Overflow vulnerability in the document foundation libreoffice. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 15-06-2026PublishedVulnerability first disclosed.
- 15-06-2026Last modifiedVulnerability information updated.
Description
LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:PDiffers
- OSV · DebianEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- NVDNIST5.4MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
+0.01 pp
From 0.15% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Debian1 product
- libreoffice< 4:7.4.7-1+deb12u13 | < 4:25.2.3-2+deb13u5 | < 4:26.2.4.2-1
The document foundation1 product
- libreoffice≥ 26.2, < < 26.2.4
Ubuntu1 product
- libreofficeAll versions (No fix recorded) | < 1:7.3.7-0ubuntu0.22.04.12 | < 4:24.2.7-0ubuntu0.24.04.6 | < 4:26.2.4.2-0ubuntu0.26.04.2
3 vendors · 3 products
