CVE-2026-8356: LibreOffice Buffer Overflow Vulnerability

CVE-2026-8356 Overview

CVE-2026-8356 is a stack buffer overflow [CWE-121] in LibreOffice's import path for the legacy binary PowerPoint (PPT) format. The flaw lives in the handling of a colour-replacement record. LibreOffice fills two fixed-size colour tables from the file across two passes, but the write index is not reset between passes. A crafted PPT whose combined colour counts exceed the table capacity writes past the end of the on-stack tables. Exploitation requires a local user to open a malicious presentation, giving the issue a user-interaction precondition typical of document parsers.

Critical Impact
A specially crafted PPT file opened in a vulnerable LibreOffice build corrupts the stack, enabling denial of service and potential local code execution in the user's context.

Affected Products

LibreOffice (versions prior to the fix referenced in the vendor advisory)
Builds that include the legacy binary PPT import filter
Downstream distributions packaging vulnerable LibreOffice releases

Discovery Timeline

2026-06-15 - CVE-2026-8356 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-8356

Vulnerability Analysis

The legacy binary PPT format encodes colour-replacement records that map source colours to replacement colours. LibreOffice's import routine allocates two fixed-size colour tables on the stack and parses the record in two passes. The first pass populates the source colour table. The second pass should populate the replacement colour table, but the shared write position is not reset to zero between passes. A file with sufficiently large combined colour counts continues writing past the bounds of the first table and corrupts adjacent stack memory.

The attacker controls the colour values written and the number of out-of-bounds writes through the file's colour counts. This control over both the offset and the data placed on the stack is the prerequisite for converting a stack overflow into code execution, though successful exploitation depends on stack layout, canaries, and ASLR on the target build.

Root Cause

The root cause is a missing reset of the destination index between the two parsing passes over a single record. The fix removes the unused second pass entirely so the unbounded write cannot occur. This is a classic [CWE-121] stack-based buffer overflow caused by trusting attacker-controlled length fields in a binary file format.

Attack Vector

An attacker delivers a malicious .ppt file through email, file sharing, or a compromised website. The victim opens the file in a vulnerable LibreOffice Impress build, triggering the import path. No network exposure or elevated privileges are required, but user interaction is mandatory. The vulnerability cannot be reached through ODF or modern OOXML PPTX import paths because the defect is specific to the legacy binary PPT filter.

No public proof-of-concept exploit code is available at the time of writing. See the LibreOffice Security Advisory CVE-2026-8356 for technical details from the vendor.

Detection Methods for CVE-2026-8356

Indicators of Compromise

LibreOffice processes such as soffice.bin crashing shortly after opening a .ppt attachment
Unexpected child processes spawned by soffice.bin following PPT file open events
Inbound .ppt files with abnormally large colour-replacement record sizes or malformed structures

Detection Strategies

Inspect mail and web gateways for legacy .ppt attachments and route them through sandbox detonation before delivery
Use endpoint telemetry to alert on stack corruption signatures, such as access violations in soffice.bin with stack-cookie failures
Correlate file-open events for .ppt files with subsequent process creation or shell activity originating from the LibreOffice process tree

Monitoring Recommendations

Track LibreOffice version inventory across managed endpoints and flag hosts running pre-patch builds
Log Watson, ABRT, or crash-reporter entries referencing soffice.bin and review them for repeated faults tied to PPT files
Monitor for unsigned .ppt files arriving from external senders, especially those originating outside normal business communications

How to Mitigate CVE-2026-8356

Immediate Actions Required

Upgrade LibreOffice to the fixed release identified in the vendor advisory on all workstations and shared file servers
Restrict opening of legacy .ppt files from untrusted sources until patching is complete
Re-image or forensically review any host where a crash in soffice.bin followed opening of an untrusted PPT

Patch Information

The Document Foundation has shipped a corrected import routine that removes the unused second pass over the colour-replacement record, eliminating the unbounded stack write. Administrators should consult the LibreOffice Security Advisory CVE-2026-8356 for the exact fixed version numbers and apply distribution-provided updates where LibreOffice is installed from a Linux package repository.

Workarounds

Block or quarantine inbound .ppt attachments at the mail gateway and require senders to use .pptx instead
Use file-type allowlists in endpoint policy to prevent users from opening legacy binary PPT files until patches are deployed
Configure LibreOffice to open untrusted documents in a sandboxed or read-only profile where feasible

bash

# Example: block legacy .ppt at a Postfix gateway via header_checks
# /etc/postfix/mime_header_checks
/name=[^\"]*\.ppt\"?/   REJECT Legacy PPT blocked pending CVE-2026-8356 patch

# Example: verify installed LibreOffice version on Debian/Ubuntu
dpkg -l | grep -i libreoffice-core

# Example: verify installed LibreOffice version on RHEL/Fedora
rpm -q libreoffice-core