CVE-2026-6040: ODF Number Format Use-After-Free Flaw

CVE-2026-6040 Overview

CVE-2026-6040 is a heap use-after-free vulnerability [CWE-416] in LibreOffice affecting the import path for OpenDocument Format (ODF) number formats. The flaw exists in code that handles blank-width characters within a format-code string. A position value read from the document is not validated against the length of the format-code string. A crafted ODF file can therefore reference memory outside the intended buffer, producing a use-after-free condition during parsing.

Critical Impact
Opening a malicious ODF document can corrupt heap memory in LibreOffice, leading to application crash or potential local code execution in the context of the user.

Affected Products

LibreOffice (versions prior to the fix referenced in the LibreOffice security advisory)
Documents processed through the ODF number-format import path
Desktop deployments on Windows, macOS, and Linux that handle untrusted .ods, .odt, or related ODF files

Discovery Timeline

2026-06-15 - CVE-2026-6040 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-6040

Vulnerability Analysis

The vulnerability resides in the ODF import logic that processes number formats containing blank-width characters. During parsing, the code reads a position value directly from the document and uses it to index into the format-code string. The position is not bounds-checked, so a malformed format can drive the index past the end of the allocated string buffer.

The resulting access touches memory that may have been freed or repurposed, producing a heap use-after-free [CWE-416]. Such conditions allow attackers to influence which object the dangling reference points to. With careful heap shaping, the read or subsequent write can corrupt adjacent allocations and pivot toward arbitrary code execution within the LibreOffice process.

The fix bounds-checks the position against the length of the format-code string before any access. This eliminates the path that returns a stale pointer or out-of-range reference during number-format processing.

Root Cause

The root cause is missing input validation. The ODF importer trusts a numeric offset stored in the document and uses it as an index without verifying that it falls within the format-code string. The underlying memory safety issue is classified as a use-after-free because the unbounded index causes operations on memory whose lifetime is no longer tied to the format-code string.

Attack Vector

Exploitation requires local user interaction. A victim must open a malicious ODF document delivered through email, a shared drive, a web download, or a collaboration platform. The CVSS 4.0 vector indicates a local attack vector with user interaction required and high availability impact, alongside low confidentiality and integrity impact.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS probability is 0.117%, reflecting low observed exploitation interest at publication time. For technical specifics, refer to the LibreOffice Security Advisory.

Detection Methods for CVE-2026-6040

Indicators of Compromise

Unexpected crashes of soffice.bin or soffice.exe immediately after opening an ODF document
ODF files (.ods, .odt, .odp) received from untrusted sources containing unusual or malformed number-format definitions
Heap corruption traces or Windows Error Reporting (WER) / coredump artifacts referencing LibreOffice number-format import code paths

Detection Strategies

Inspect ODF documents statically for number-format strings containing abnormal blank-width character sequences or out-of-range position values
Monitor endpoints for LibreOffice processes spawning unexpected child processes such as command shells, scripting hosts, or network utilities
Correlate document-open events with subsequent process crashes or memory protection violations in office suite binaries

Monitoring Recommendations

Enable application crash telemetry for soffice and forward it to a centralized log platform for analysis
Track inbound ODF attachments through mail and web gateways, especially from external or low-reputation senders
Alert on anomalous file-system or network activity originating from LibreOffice processes shortly after document open

How to Mitigate CVE-2026-6040

Immediate Actions Required

Upgrade LibreOffice to the fixed version listed in the LibreOffice Security Advisory
Inventory all systems running LibreOffice, including developer workstations, kiosks, and Linux servers used for document conversion
Block or quarantine ODF documents from untrusted external sources at the email and web gateway until patches are applied

Patch Information

The LibreOffice project has released fixed builds that bounds-check the position value before it is used to index into the format-code string. Administrators should apply the vendor-provided update on all supported platforms. Detailed version information is published in the LibreOffice Security Advisory.

Workarounds

Avoid opening ODF documents from untrusted or unverified sources until the patch is deployed
Open suspicious documents inside a sandboxed virtual machine or container with no sensitive data and restricted network access
Use a hardened ODF previewer or convert untrusted documents to a safe rendered format (such as PDF via a server-side converter) before user review

bash

# Example: verify installed LibreOffice version on Linux endpoints
libreoffice --version

# Example: enforce upgrade via package manager (Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade libreoffice

# Example: enforce upgrade via package manager (RHEL/Fedora)
sudo dnf upgrade libreoffice