Vulnerability · Published Jun 15, 2026 · Assigned by Document Fdn.
CVE-2026-6047Heap buffer overflow in OOXML text box element import
Medium 5.4
In plain English
A medium-severity out-of-bounds write in LibreOffice from The Document Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | libreoffice | 4:26.2.3.2-2 | DEBIAN-CVE-2026-6047 |
| Ubuntu:26.04:LTS | libreoffice | 4:26.2.4.2-0ubuntu0.26.04.2 | UBUNTU-CVE-2026-6047 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Document Foundation | LibreOffice | 25.8 – before < 25.8.726.2 – before < 26.2.3 |
Weakness: CWE-787, CWE-843 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P