CVE-2026-6045: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-6045 is a heap buffer overflow vulnerability in LibreOffice's EMF+ graphics import functionality, specifically triggered when parsing gradient brush data. The root cause is an integer multiplication overflow when computing the allocation size from the number of gradient blend points read from a file, resulting in an undersized heap buffer that is subsequently overwritten. Affected versions include LibreOffice 25.8 series before 25.8.7 and 26.2 series before 26.2.3. It was published on June 15, 2026, with a CVSS v3.1 score of 6.6 (Medium) and a CVSS v4.0 score of 5.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound) and CWE-787 (Out-of-bounds Write). When LibreOffice imports an EMF+ document containing a gradient brush, it reads the number of blend points from the file and multiplies that value to compute a heap allocation size. This multiplication can overflow, causing a much smaller buffer to be allocated than expected; the code then proceeds to fill the buffer as if it were the intended larger size, writing past the end of the heap allocation. The attack vector is local and requires user interaction — a victim must open a specially crafted document containing malicious EMF+ graphics. Fixed versions validate the blend-point count against the data actually available in the file before performing the allocation (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in arbitrary code execution with the privileges of the LibreOffice process, as well as application crashes (denial of service). The CVSS scoring reflects high availability impact and low confidentiality and integrity impacts, meaning an attacker could potentially read limited data, make minor unauthorized modifications, and crash the application. Because exploitation requires a user to open a malicious document, the attack scope is limited to the affected workstation and does not directly enable lateral movement, though code execution could be leveraged as an initial foothold (GitHub Advisory).

As of the time of reporting, there is no confirmed public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The CVSS v4.0 exploit maturity is rated "Proof of Concept," suggesting limited exploit code may exist in research contexts. The EPSS score is approximately 0.119%, placing it in the 2nd percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no specific threat actor attribution has been reported.

1. Craft a malicious document: Create a document (e.g., ODT, DOCX, or other LibreOffice-supported format) that embeds a specially crafted EMF+ graphic containing a gradient brush record with a manipulated blend-point count designed to trigger an integer overflow during size computation.
2. Deliver the document: Use social engineering, phishing email, or a malicious download link to deliver the crafted document to a target user running a vulnerable version of LibreOffice (25.8 series < 25.8.7 or 26.2 series < 26.2.3).
3. Trigger the vulnerability: The victim opens the document in LibreOffice, which attempts to import the embedded EMF+ graphic. The gradient brush parser reads the attacker-controlled blend-point count and performs the overflowing multiplication, allocating an undersized heap buffer.
4. Heap buffer overflow: LibreOffice writes gradient blend point data into the undersized buffer, overwriting adjacent heap memory with attacker-controlled content.
5. Achieve code execution or crash: Depending on heap layout and exploit reliability, the attacker may achieve arbitrary code execution with the privileges of the LibreOffice process, or at minimum cause a denial-of-service crash (GitHub Advisory, Red Hat Bugzilla).

• File System: Presence of unexpected or unsolicited document files (ODT, DOCX, etc.) containing embedded EMF+ graphics delivered via email or download; suspicious files in temporary directories created during LibreOffice document processing.
• Process: LibreOffice process (soffice, soffice.bin) spawning unexpected child processes (e.g., shells, network utilities); abnormal termination or crash of LibreOffice with memory corruption signals (SIGSEGV, SIGABRT).
• Logs: Application crash reports or core dumps referencing LibreOffice EMF+ or gradient brush parsing code paths; system logs showing LibreOffice process crashes shortly after opening a document.
• Network: Outbound network connections initiated by the LibreOffice process to unexpected external hosts, which may indicate post-exploitation activity if code execution was achieved.

Users should upgrade LibreOffice to version 25.8.7 or later (in the 25.8 series) or 26.2.3 or later (in the 26.2 series) to receive the fix, which validates the blend-point count against available data before buffer allocation (GitHub Advisory). As a temporary workaround until patching is possible, organizations should restrict users from opening untrusted documents containing EMF+ graphics, and consider disabling EMF+ graphic import functionality if it is not operationally required. User awareness training to avoid opening unsolicited or unexpected documents is also recommended.

Red Hat has tracked the vulnerability via its Bugzilla system and assigned it medium severity, with the bug filed by OSIDB Bzimport on the day of disclosure (Red Hat Bugzilla). Debian has issued updates for LibreOffice packages addressing this vulnerability, as noted in Linux compatibility update announcements. Tenable has published Nessus detection plugins (IDs 321128, 321135, 321496) to identify vulnerable LibreOffice installations. No significant public researcher commentary or social media discussion has been observed beyond standard vulnerability tracking and aggregation.