Vulnerability · Published Jun 15, 2026 · Assigned by Document Fdn.
CVE-2026-6045Heap buffer overflow in EMF+ gradient brush import
Medium 5.4
In plain English
A medium-severity out-of-bounds write in LibreOffice from The Document Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and then filled as if it were large, writing past its end. In fixed versions the blend-point count is checked against the data actually available before allocating.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libreoffice | 4:7.4.7-1+deb12u13 | DEBIAN-CVE-2026-6045 |
| Debian:13 | libreoffice | 4:25.2.3-2+deb13u5 | DEBIAN-CVE-2026-6045 |
| Debian:14 | libreoffice | 4:26.2.3.2-2 | DEBIAN-CVE-2026-6045 |
| Ubuntu:22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.12 | UBUNTU-CVE-2026-6045 |
| Ubuntu:22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.12 | USN-8534-1 |
| Ubuntu:24.04:LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.6 | USN-8534-1 |
| Ubuntu:24.04:LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.6 | UBUNTU-CVE-2026-6045 |
| Ubuntu:25.10 | libreoffice | no fix listed | UBUNTU-CVE-2026-6045 |
| Ubuntu:26.04:LTS | libreoffice | 4:26.2.4.2-0ubuntu0.26.04.2 | USN-8534-1 |
| Ubuntu:26.04:LTS | libreoffice | 4:26.2.4.2-0ubuntu0.26.04.2 | UBUNTU-CVE-2026-6045 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Document Foundation | LibreOffice | 25.8 – before < 25.8.726.2 – before < 26.2.3 |
Weakness: CWE-787, CWE-190 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P