Critical Vulnerability in LibreOffice: Heap Buffer Overflow in Calc
Summary
ALSA-2026:35839: Important: libreoffice security update. Affects autocorr-af versions < 1:6.4.7.2-21.el8_10.alma.1. Fixed in 1:6.4.7.2-21.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
LibreOffice is an open-source office productivity suite that includes applications for word processing, spreadsheets, presentations, and more. It is designed to be a free alternative to proprietary office software, providing users with powerful tools for document creation and management. The suite is widely used across various platforms and is known for its compatibility with multiple file formats. However, a critical vulnerability has been identified in LibreOffice Calc, which could allow arbitrary code execution due to a heap buffer overflow during formula compilation.
Vulnerability Detail
The vulnerability (CVE-2026-8357) arises from a heap buffer overflow in LibreOffice Calc, specifically during the compilation of formulas. This flaw can be exploited by an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or system compromise. The issue is particularly concerning as it can be triggered by opening a specially crafted spreadsheet file, making users vulnerable without their knowledge. The severity of this vulnerability necessitates immediate attention and remediation.
How To Fix
Minimum fixed version
1:6.4.7.2-21.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update autocorr-afTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening untrusted spreadsheet files until the patch is applied. Additionally, disabling macros in LibreOffice settings may help mitigate the risk of exploitation through malicious files.
Conclusion
The identified vulnerability in LibreOffice Calc poses a significant risk to users, allowing for potential arbitrary code execution through specially crafted spreadsheet files. It is crucial for users to update to the latest patched version to mitigate this risk. Until the update is applied, users should exercise caution when handling spreadsheet files from untrusted sources.
See every vulnerability recorded for autocorr-af →
FAQ
CVE-2026-8357 is the identifier for a critical vulnerability in LibreOffice Calc that allows arbitrary code execution due to a heap buffer overflow.
If you are using a version prior to 1:6.4.7.2-21.el8_10.alma.1, your installation is vulnerable. You can check your version by navigating to Help > About LibreOffice.
If an immediate update is not possible, avoid opening any spreadsheet files from untrusted sources and consider disabling macros as a precaution.
More details can be found on the CVE page for CVE-2026-8357, which provides insights into the vulnerability's impact and technical details.
Vulert monitors and alerts users in real-time for open-source vulnerabilities in software using a manifest file like package-lock.json. You can check if your application is affected by vulnerabilities without needing to install any software.
Related vulnerabilities
Recent vulnerabilities recorded for autocorr-af.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
