CVE-2026-6045: LibreOffice Buffer Overflow Vulnerability

CVE-2026-6045 Overview

CVE-2026-6045 is a heap buffer overflow in LibreOffice triggered when importing Enhanced Metafile Format Plus (EMF+) graphics embedded in documents. The flaw resides in the EMF+ gradient brush import path, where an integer overflow during allocation size computation produces an undersized heap buffer. LibreOffice then writes data past the end of that buffer, corrupting adjacent heap memory. Exploitation requires a user to open a crafted document containing a malicious EMF+ graphic. The issue is tracked under CWE-190: Integer Overflow or Wraparound. Fixed releases validate the gradient blend-point count against the data actually available in the file before allocating memory.

Critical Impact
A crafted EMF+ gradient brush can corrupt heap memory in LibreOffice, leading to application compromise when a victim opens the document.

Affected Products

LibreOffice (versions prior to the fix referenced in the LibreOffice Security Advisory)
Documents containing embedded EMF+ graphics processed by the affected import path
Workstations where users open untrusted office documents in LibreOffice

Discovery Timeline

2026-06-15 - CVE-2026-6045 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-6045

Vulnerability Analysis

The vulnerability occurs in the LibreOffice import logic for EMF+ gradient brushes. EMF+ is a graphics record format that may be embedded inside Office documents and rendered by LibreOffice during file open. The gradient brush record carries a count of blend points alongside the corresponding color and position arrays.

The import routine reads the blend-point count directly from the attacker-controlled file. It then multiplies that count by the per-element size to determine an allocation length. The multiplication can wrap around the native integer width, producing a small allocation size. The code subsequently copies blend-point data into the undersized buffer using the original count, writing well past its end.

This is a classic [CWE-190] integer overflow that escalates into a heap buffer overflow. Heap corruption can lead to denial of service through process crash and, depending on heap layout and allocator behavior, may enable arbitrary code execution in the context of the user running LibreOffice.

Root Cause

The import code trusts the attacker-supplied blend-point count without validating it against the bytes actually present in the EMF+ record. The allocation size calculation does not use checked arithmetic, so the multiplication silently overflows for large counts. Fixed versions verify the count against the available record data before allocating.

Attack Vector

The attack requires local user interaction. An attacker delivers a document with an embedded malicious EMF+ graphic through email, file share, or web download. When the victim opens the document in a vulnerable LibreOffice build, the import routine processes the gradient brush record and corrupts the heap. The CVSS vector indicates a local attack vector with user interaction required and high availability impact.

No verified proof-of-concept code is publicly available. See the
[LibreOffice Security Advisory](https://www.libreoffice.org/about-us/security/advisories/cve-2026-6045)
for technical details and patch references.

Detection Methods for CVE-2026-6045

Indicators of Compromise

LibreOffice processes (soffice.bin, soffice) crashing shortly after opening a document containing embedded graphics
Heap corruption signatures, AddressSanitizer reports, or Windows Error Reporting entries originating from EMF+ import code paths
Inbound documents (.docx, .odt, .rtf, .doc) containing unusually large or malformed embedded EMF/EMF+ streams

Detection Strategies

Inspect office documents at the mail gateway for embedded EMF+ records with anomalously large blend-point counts in gradient brush objects
Monitor endpoint telemetry for child process anomalies, unexpected memory allocations, or shellcode-like behavior spawned from LibreOffice processes
Hunt for LibreOffice processes that write to or execute from user-writable directories immediately after opening a document

Monitoring Recommendations

Alert on LibreOffice process crashes correlated with document open events in EDR or SIEM telemetry
Track LibreOffice version inventory across endpoints to identify hosts still running pre-patch builds
Log and review documents flagged by content disarm and reconstruction tools as containing malformed EMF+ records

How to Mitigate CVE-2026-6045

Immediate Actions Required

Upgrade LibreOffice to the fixed version referenced in the LibreOffice Security Advisory on all workstations
Block or quarantine inbound documents from untrusted senders that contain embedded EMF/EMF+ graphics until patching completes
Educate users to avoid opening unexpected office documents, especially those received from external sources

Patch Information

The Document Foundation has published fixed LibreOffice releases that validate the EMF+ gradient brush blend-point count against the available record data before allocating memory. Apply the version specified in the LibreOffice Security Advisory. Enterprises managing LibreOffice through package managers or MDM should push the update through their standard software distribution pipeline.

Workarounds

Disable or restrict opening of documents from untrusted sources until the patched LibreOffice build is deployed
Use a sandboxed viewer or a separate low-privilege account for opening untrusted documents containing embedded graphics
Apply attachment filtering policies that strip or flag office files containing embedded EMF/EMF+ streams at the mail gateway

bash

# Example: verify installed LibreOffice version on Linux
soffice --version

# Example: upgrade LibreOffice via common package managers
sudo apt update && sudo apt install --only-upgrade libreoffice
sudo dnf upgrade libreoffice