Log in Start free

Vulnerability · Published Jun 15, 2026 · Assigned by Document Fdn.

CVE-2026-6040Heap use-after-free in ODF number-format blank-width parsing

High 7.3

In plain English

A high-severity use-after-free in LibreOffice from The Document Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.2%top 94.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13libreoffice4:25.2.3-2+deb13u5DEBIAN-CVE-2026-6040
Debian:14libreoffice4:26.2.3.2-2DEBIAN-CVE-2026-6040
Ubuntu:22.04:LTSlibreoffice1:7.3.7-0ubuntu0.22.04.12USN-8534-1
Ubuntu:24.04:LTSlibreoffice4:24.2.7-0ubuntu0.24.04.6USN-8534-1
Ubuntu:24.04:LTSlibreoffice4:24.2.7-0ubuntu0.24.04.6UBUNTU-CVE-2026-6040
Ubuntu:25.10libreofficeno fix listedUBUNTU-CVE-2026-6040
Ubuntu:26.04:LTSlibreoffice4:26.2.4.2-0ubuntu0.26.04.2USN-8534-1
Ubuntu:26.04:LTSlibreoffice4:26.2.4.2-0ubuntu0.26.04.2UBUNTU-CVE-2026-6040

Affected products (as reported)

VendorProductVersions
The Document Foundation LibreOffice 25.8 – before < 25.8.726.2 – before < 26.2.3

Weakness: CWE-416, CWE-787, CWE-825 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References