7.8

CVE-2026-8357: the document foundation libreoffice Off-by-one Error

CVSS: 7.8v3.1HighDeferred
AliasesRHSA-2026:35839RHSA-2026:36832RHSA-2026:43423
Published 15-06-2026Last modified 28-07-2026

Vulnerability summary

CVE-2026-8357 is a high (CVSS 7.8) Off-by-one Error vulnerability in the document foundation libreoffice. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.5% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.23%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 2

Timeline

  1. 15-06-2026
    PublishedVulnerability first disclosed.
  2. 28-07-2026
    Last modifiedVulnerability information updated.

Description

LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.

CVSS metrics

8 scores · 5 sources · 2 versions

EPSS trend

Probability

0.23%

Chance of exploitation in the next 30 days

Percentile

13%

Versus all other CVEs

30-day change

+0.01 pp

From 0.22% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.23%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat198 products
  • autocorr-af< 1:6.4.7.2-21.el8_10 | < 1:7.1.8.1-15.el9_8.2 | < 1:7.1.8.1-14.el9_2.2 | < 1:7.1.8.1-15.el9_4.2 | < 1:7.1.8.1-15.el9_6.2 | < 1:6.4.7.2-18.el8_8.2 | < 1:6.4.7.2-18.el8_6.2 | < 1:6.4.7.2-18.el8_4.2
  • autocorr-bg< 1:6.4.7.2-21.el8_10 | < 1:7.1.8.1-15.el9_8.2 | < 1:7.1.8.1-14.el9_2.2 | < 1:7.1.8.1-15.el9_4.2 | < 1:7.1.8.1-15.el9_6.2 | < 1:6.4.7.2-18.el8_8.2 | < 1:6.4.7.2-18.el8_6.2 | < 1:6.4.7.2-18.el8_4.2
  • autocorr-ca< 1:6.4.7.2-21.el8_10 | < 1:7.1.8.1-15.el9_8.2 | < 1:7.1.8.1-14.el9_2.2 | < 1:7.1.8.1-15.el9_4.2 | < 1:7.1.8.1-15.el9_6.2 | < 1:6.4.7.2-18.el8_8.2 | < 1:6.4.7.2-18.el8_6.2 | < 1:6.4.7.2-18.el8_4.2
  • autocorr-cs< 1:6.4.7.2-21.el8_10 | < 1:7.1.8.1-15.el9_8.2 | < 1:7.1.8.1-14.el9_2.2 | < 1:7.1.8.1-15.el9_4.2 | < 1:7.1.8.1-15.el9_6.2 | < 1:6.4.7.2-18.el8_8.2 | < 1:6.4.7.2-18.el8_6.2 | < 1:6.4.7.2-18.el8_4.2
  • autocorr-da< 1:6.4.7.2-21.el8_10 | < 1:7.1.8.1-15.el9_8.2 | < 1:7.1.8.1-14.el9_2.2 | < 1:7.1.8.1-15.el9_4.2 | < 1:7.1.8.1-15.el9_6.2 | < 1:6.4.7.2-18.el8_8.2 | < 1:6.4.7.2-18.el8_6.2 | < 1:6.4.7.2-18.el8_4.2
Debian1 product
  • libreoffice< 4:7.4.7-1+deb12u13 | < 4:25.2.3-2+deb13u5 | < 4:26.2.4.2-1
Ubuntu1 product
  • libreofficeAll versions (No fix recorded) | < 1:7.3.7-0ubuntu0.22.04.12 | < 4:24.2.7-0ubuntu0.24.04.6 | < 4:26.2.4.2-0ubuntu0.26.04.2

3 vendors · 200 products · Showing 200 of 201. Use Open JSON for the complete list.

References

27 links
Show all 27 references