RLSA-2026:88164: LibreOffice and related Rocky Linux 8 packages security update
Summary
RLSA-2026:88164: Malformed PDF or font data can trigger memory corruption, while a remote Java database driver can enable arbitrary code execution. Affects flute versions < 0:1.3.0-19.OOo31.el8_10. Fixed in 0:1.3.0-19.OOo31.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreOffice is an office productivity suite distributed in the Rocky Linux 8 ecosystem. The advisory covers LibreOffice and related reporting and library packages, including components for loading, fonts, layout, serialization, and reporting. These packages support document processing and reporting functionality; the advisory also lists bug fixes and enhancements alongside security fixes.
Vulnerability Detail
The advisory describes memory-corruption vulnerabilities and arbitrary code execution affecting LibreOffice. A heap buffer overflow occurs in PDF import stream handling, and stack buffer overflows occur during CFF to Type 1 font conversion and CFF font hint handling. It also reports arbitrary code execution through a remote Java database driver. The listed issues can compromise confidentiality, integrity, and availability; the supplied CVSS vector rates the severity as high.
How To Fix
Minimum fixed version
0:1.3.0-19.OOo31.el8_10
This is the first release that contains the fix.
sudo dnf update fluteTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict access to LibreOffice document processing and avoid importing untrusted PDFs or CFF fonts until the affected packages are updated. Disable or restrict use of remote Java database drivers where operationally feasible.
Conclusion
Bottom line: upgrade each affected package to its listed minimum fixed version; the required version varies by package. The advisory covers LibreOffice and related Rocky Linux 8 packages, with fixes for memory corruption and arbitrary code execution. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for flute →
FAQ
RLSA-2026:88164 lists affected package ranges beginning at version 0; fixed versions vary by package, including LibreOffice and related libraries.
RLSA-2026:88164 reports memory corruption from malformed PDF or font handling and arbitrary code execution through a remote Java database driver.
RLSA-2026:88164 is fixed by package-specific updates; for example, LibreOffice's minimum fixed version is 1:7.1.8.1-3.el8_10.
For RLSA-2026:88164, restrict document processing, avoid untrusted PDFs and CFF fonts, and limit remote Java database driver use.
Inspect a manifest or SBOM for the affected package names and versions. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
