CVE-2026-8358: LibreOffice Calc Buffer Overflow Flaw

CVE-2026-8358 Overview

CVE-2026-8358 is a heap buffer overflow vulnerability [CWE-787] in LibreOffice Calc's tracked changes import routine. The flaw occurs when a spreadsheet document reuses the same change identifier for two different kinds of tracked changes. The importer treats one change object as a different, larger type and writes past the end of its heap allocation. An attacker must deliver a crafted spreadsheet and convince a user to open it. Successful exploitation can corrupt heap memory and crash the application or potentially enable code execution in the context of the local user.

Critical Impact
A crafted LibreOffice Calc spreadsheet with duplicate tracked-change identifiers triggers an out-of-bounds heap write, risking application compromise on the local system.

Affected Products

LibreOffice Calc (versions prior to the fix)
The Document Foundation LibreOffice suite
Downstream LibreOffice distributions that bundle the affected Calc import code

Discovery Timeline

2026-06-15 - CVE-2026-8358 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-8358

Vulnerability Analysis

LibreOffice Calc supports importing tracked changes embedded in spreadsheet documents. Each tracked change carries an identifier that the importer uses to associate metadata with a change object. The vulnerability arises when two records share the same identifier but represent different kinds of change.

The importer allocates a change object based on the type encountered first. When the second record with the duplicate identifier is processed, the code reuses the existing allocation and writes data sized for a larger type into the smaller buffer. The result is an out-of-bounds heap write that corrupts adjacent memory.

The issue is classified under [CWE-787] Out-of-bounds Write. EPSS rates the probability of exploitation in the next 30 days at 0.131%.

Root Cause

The root cause is missing validation of change identifier uniqueness during deserialization of tracked changes. The importer assumes identifiers map one-to-one with a single change object type. It does not detect collisions between records of different kinds, leading to a type confusion that drives a heap buffer overflow at write time.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a malicious spreadsheet through email, file share, or web download. When the victim opens the document in a vulnerable LibreOffice Calc build, the import code processes the duplicate identifier and writes past the end of the allocation. The corrupted heap can produce a crash or be shaped to influence control flow within the user's session.

No network access, elevated privileges, or authentication bypass is required. The CVSS 4.0 vector reports the attack as local with passive user interaction needed.

No verified public proof-of-concept code is available. See the LibreOffice Security Advisory for vendor technical details.

Detection Methods for CVE-2026-8358

Indicators of Compromise

Unexpected crashes of soffice.bin or LibreOffice Calc shortly after opening a spreadsheet attachment
Spreadsheet files (.ods, .xlsx, .xls) containing tracked-change records that reuse the same change identifier across different change types
Child processes spawned by LibreOffice Calc that are inconsistent with normal office workflows

Detection Strategies

Inspect inbound spreadsheet attachments for malformed or duplicate tracked-change identifiers prior to delivery
Monitor endpoint telemetry for application crashes and heap corruption signatures in LibreOffice processes
Correlate document open events with subsequent anomalous process behavior, memory faults, or unexpected file writes

Monitoring Recommendations

Enable crash reporting and core dump collection for LibreOffice on managed endpoints to surface exploitation attempts
Log document open events and downstream process activity through an endpoint detection and response (EDR) sensor
Track LibreOffice version inventory across the fleet to confirm patched builds are deployed

How to Mitigate CVE-2026-8358

Immediate Actions Required

Update LibreOffice to a fixed version that rejects records containing duplicate change identifiers
Block or quarantine spreadsheet attachments from untrusted senders until patching is complete
Advise users to avoid opening unsolicited .ods, .xlsx, or .xls files, especially those containing tracked changes

Patch Information

The Document Foundation has released fixed LibreOffice builds in which the Calc importer rejects records with duplicate change identifiers, eliminating the type confusion that drives the heap buffer overflow. Refer to the LibreOffice Security Advisory for the specific fixed version numbers and download links applicable to each supported branch.

Workarounds

Disable tracked-changes import or avoid opening spreadsheets that contain tracked changes from untrusted sources
Open suspect spreadsheets only inside a sandboxed or disposable virtual machine without access to sensitive data
Apply application allow-listing to restrict LibreOffice execution paths and prevent child-process abuse

bash

# Example: verify installed LibreOffice version on Linux endpoints
libreoffice --version

# Example: bulk-check version across hosts via SSH
for host in $(cat hosts.txt); do
  ssh "$host" 'libreoffice --version' \
    | awk -v h="$host" '{print h": "$0}'
done