CVE-2026-6047: LibreOffice Buffer Overflow Vulnerability

CVE-2026-6047 Overview

CVE-2026-6047 is a heap buffer overflow [CWE-787] in LibreOffice affecting the Office Open XML (OOXML) document import path used for DOCX files. The flaw occurs when LibreOffice replays deferred parser events for a text box element. The code assumes a handler object is one type and writes data using that type's field layout, but the object may be a smaller allocation. The write then lands past the end of the allocated buffer, corrupting adjacent heap memory. A crafted DOCX document opened by a user can trigger the condition. Fixed builds add a type check before performing the write.

Critical Impact
A malicious DOCX file can corrupt heap memory in LibreOffice, leading to application crashes and potential code execution within the user's session.

Affected Products

LibreOffice (OOXML/DOCX import component)
LibreOffice deployments processing untrusted DOCX documents
Downstream distributions packaging vulnerable LibreOffice builds

Discovery Timeline

2026-06-15 - CVE-2026-6047 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-6047

Vulnerability Analysis

The vulnerability resides in the OOXML import logic that handles DOCX text box elements. During parsing, LibreOffice queues deferred events that are replayed once the surrounding document context is available. When these events are replayed, the code retrieves a handler object and writes to fields based on an assumed object type.

The assumption is not validated at the time of the write. If the actual object is a smaller subclass or unrelated type with a smaller allocation, the offset used for the field write extends beyond the object's heap allocation. This produces an out-of-bounds heap write that corrupts adjacent heap data structures.

Exploitation requires the victim to open a crafted DOCX file in LibreOffice. The attack vector is local and requires user interaction, but no authentication is needed.

Root Cause

The root cause is missing runtime type validation before a polymorphic write operation. The fixed versions add a type check on the handler object before writing to the type-specific field. This prevents writes that exceed the actual allocation size of the underlying object.

Attack Vector

An attacker delivers a malicious DOCX file by email, web download, file share, or any document distribution channel. When a user opens the file in a vulnerable LibreOffice build, the OOXML parser processes the embedded text box element. Deferred event replay then triggers the out-of-bounds write. The corrupted memory can crash the application or, with careful heap layout grooming, be steered toward control-flow hijack within the user's privilege context.

No verified public exploit code is available for CVE-2026-6047. See the LibreOffice Security Advisory CVE-2026-6047 for technical details.

Detection Methods for CVE-2026-6047

Indicators of Compromise

Unexpected soffice.bin or soffice.exe crashes immediately after opening a DOCX file
Heap corruption signatures or access violations in LibreOffice crash reports referencing OOXML import code paths
Inbound DOCX attachments from untrusted senders with embedded text box structures that fail schema validation

Detection Strategies

Monitor endpoint telemetry for LibreOffice process crashes correlated with DOCX file opens
Inspect mail and web gateways for DOCX attachments and flag files with malformed OOXML text box markup
Track child processes spawned by soffice after a document open event, which is unusual for benign DOCX viewing

Monitoring Recommendations

Enable application crash reporting and forward dump metadata to a central log store for review
Alert on LibreOffice processes performing network connections or writing to autorun locations after opening a document
Correlate document-open events with subsequent suspicious process behavior to surface exploitation attempts

How to Mitigate CVE-2026-6047

Immediate Actions Required

Upgrade LibreOffice to the fixed version identified in the LibreOffice Security Advisory CVE-2026-6047
Block or quarantine DOCX attachments from untrusted external senders pending patch rollout
Educate users to avoid opening unsolicited DOCX files and to validate document sources

Patch Information

The LibreOffice project has released fixed builds that add a type check on the handler object before the deferred parser event write. Refer to the LibreOffice security advisory for the exact fixed version numbers and apply the vendor-supplied packages or distribution updates.

Workarounds

Configure LibreOffice to open documents from untrusted sources in a sandboxed user account or container
Use protected view or read-only mode where supported, and disable automatic processing of embedded objects
Restrict DOCX handling to a dedicated conversion host isolated from sensitive systems until patches are deployed

bash

# Example: verify installed LibreOffice version on Linux
libreoffice --version

# Example: update via distribution package manager
sudo apt update && sudo apt install --only-upgrade libreoffice