CVE-2026-8357: LibreOffice Calc Buffer Overflow Vulnerability

CVE-2026-8357 Overview

CVE-2026-8357 is a heap buffer overflow vulnerability in LibreOffice Calc. The flaw occurs when Calc compiles cell formulas during spreadsheet opening. A specially crafted formula made up of many opening tokens triggers an out-of-bounds write in the array that tracks formula nesting depth. The array was allocated one element too small for the worst-case nesting scenario, causing the compiler to write one element past its end. This is classified as an off-by-one error [CWE-193]. Exploitation requires a local user to open a malicious spreadsheet file, making user interaction a prerequisite for any attack.

Critical Impact
Opening a crafted spreadsheet in a vulnerable LibreOffice Calc build can corrupt heap memory and crash the application, with potential for further memory-corruption consequences.

Affected Products

LibreOffice Calc (versions prior to the fixed release)
LibreOffice suite distributions containing the affected Calc component
Downstream packages bundling vulnerable LibreOffice builds

Discovery Timeline

2026-06-15 - CVE-2026-8357 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-8357

Vulnerability Analysis

The vulnerability resides in the formula compiler within LibreOffice Calc. When a spreadsheet is opened, Calc parses and compiles each cell's formula expression. During compilation, the engine maintains an array that tracks the current nesting depth of opening tokens such as parentheses and function calls. The array is sized to accommodate the maximum supported nesting depth, but the allocation was off by one element. A formula constructed entirely of opening tokens up to the maximum supported depth writes one entry beyond the end of this array. The result is a heap buffer overflow of a single element into adjacent heap memory.

Root Cause

The root cause is an off-by-one allocation error [CWE-193]. The nesting-tracking array was sized using a bound that did not include the highest-depth element required by a maximally nested expression. In fixed versions, the array is sized to hold the largest possible nesting, eliminating the boundary miscalculation.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a spreadsheet file containing a single very long formula composed of many opening tokens. The attacker delivers the file through email, file sharing, or a download link. When a victim opens the spreadsheet in a vulnerable LibreOffice Calc build, the formula compiler triggers the overflow. The immediate observable outcome is heap corruption, which typically manifests as a crash but may have further memory-safety implications depending on the heap layout. See the LibreOffice Security Advisory CVE-2026-8357 for vendor technical details.

// No verified proof-of-concept code is published for this CVE.
// Conceptually, the trigger is a cell containing a formula such as:
//   =FUNC(FUNC(FUNC(... up to maximum nesting depth ...
// where the count of opening tokens reaches the depth bound that
// causes the compiler to write one element past the tracking array.

Detection Methods for CVE-2026-8357

Indicators of Compromise

Unexpected crashes of soffice.bin or scalc immediately after opening a spreadsheet file
Spreadsheet files containing single cells with abnormally deep formula nesting or extreme counts of opening parentheses or function tokens
Heap corruption signatures or aborts logged by glibc, AddressSanitizer, or Windows Error Reporting tied to LibreOffice processes

Detection Strategies

Inspect inbound spreadsheet attachments for cells whose formula length and opening-token counts approach Calc's maximum nesting depth
Monitor endpoint telemetry for LibreOffice process crashes correlated with the opening of .ods, .xlsx, or .xls files
Use file-type-aware content inspection at the email and web gateway to flag spreadsheets exhibiting anomalous formula structures

Monitoring Recommendations

Collect and centralize application crash logs from workstations running LibreOffice
Alert on repeated crashes of LibreOffice components across multiple endpoints, which may indicate a campaign distributing crafted spreadsheets
Track installed LibreOffice versions across the fleet to identify hosts still running vulnerable builds

How to Mitigate CVE-2026-8357

Immediate Actions Required

Update LibreOffice to the fixed version identified in the LibreOffice Security Advisory CVE-2026-8357
Instruct users not to open spreadsheets from untrusted or unverified senders until patches are applied
Prioritize patching on endpoints that routinely process spreadsheets from external parties

Patch Information

The LibreOffice project has released fixed builds in which the nesting-depth tracking array is sized to hold the largest possible nesting. Administrators should consult the LibreOffice Security Advisory CVE-2026-8357 for the specific fixed version numbers and download official packages or distribution updates accordingly.

Workarounds

Open untrusted spreadsheets in a sandboxed virtual machine or container until patches are deployed
Configure mail and file-sharing gateways to quarantine spreadsheet files from external senders pending review
Disable automatic preview or auto-open of spreadsheet attachments in mail clients and file managers

bash

# Example: update LibreOffice on Debian or Ubuntu systems
sudo apt update
sudo apt install --only-upgrade libreoffice libreoffice-calc

# Example: update LibreOffice on Fedora or RHEL systems
sudo dnf upgrade libreoffice libreoffice-calc

# Verify the installed version after patching
libreoffice --version