CVE-2026-6047: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-6047 is a heap buffer overflow vulnerability in LibreOffice's OOXML (DOCX) document parser that can lead to denial of service or potential code execution. It affects LibreOffice versions in the 25.8 series prior to 25.8.7 and the 26.2 series prior to 26.2.3, developed by The Document Foundation. The vulnerability was published on June 15, 2026, with patches available on the same day. It carries a CVSS v3.1 base score of 5.0 (Medium) and a CVSS v4.0 base score of 5.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a combination of out-of-bounds write (CWE-787) and type confusion (CWE-843) in LibreOffice's OOXML import subsystem. When replaying deferred parser events for a text box element, a handler object is incorrectly assumed to be of a specific type and written to using that type's field layout. If the actual object is smaller, the write operation extends past the end of the heap allocation, resulting in a heap buffer overflow. The fix introduces a type check before the write operation is performed (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation primarily causes a denial of service by crashing the LibreOffice process due to the heap buffer overflow. Under certain conditions, the vulnerability may also allow an attacker to execute arbitrary code with the privileges of the LibreOffice process, with limited confidentiality and integrity impact on the vulnerable system. The attack is confined to the local system scope and does not affect subsequent systems, but could expose data accessible to the LibreOffice process if code execution is achieved (GitHub Advisory).

Exploitation requires a victim user to open a specially crafted DOCX file, making user interaction a prerequisite. The CVSS v4.0 exploit maturity is rated as "Proof of Concept," though no public PoC code or active in-the-wild exploitation has been confirmed at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the EPSS score is approximately 0.12%, indicating a low near-term exploitation probability. NVD's SSVC assessment classifies exploitation as "none" and the process as non-automatable (GitHub Advisory).

1. Craft malicious DOCX: Create a specially crafted OOXML (DOCX) document containing a malformed text box element designed to trigger the type confusion during deferred parser event replay.
2. Deliver the document: Send the malicious DOCX to a target LibreOffice user via email, file share, or download link — no authentication or special privileges are required on the attacker's side.
3. Victim opens the file: The target user opens the document in a vulnerable version of LibreOffice (25.8 series < 25.8.7 or 26.2 series < 26.2.3).
4. Trigger heap overflow: LibreOffice's OOXML parser replays deferred parser events for the text box element; the handler object type is not validated, causing a write past the end of the heap allocation.
5. Achieve impact: Depending on heap layout and memory conditions, the overflow results in a crash (denial of service) or, in a more advanced scenario, arbitrary code execution with the privileges of the LibreOffice process (GitHub Advisory).

• File System: Presence of unexpected or suspicious DOCX files received from unknown sources, particularly those containing complex text box elements.
• Process: Unexpected crashes or abnormal termination of the LibreOffice process (soffice, soffice.bin) when opening DOCX files; crash dump files (e.g., core dumps on Linux) generated by the LibreOffice process.
• Logs: Application crash logs or system logs (e.g., /var/log/syslog, Windows Event Viewer) showing LibreOffice process termination with signals such as SIGSEGV or SIGABRT shortly after opening a DOCX file.
• Network: Outbound connections from the LibreOffice process to unexpected external hosts (indicative of potential code execution payload delivery) (Red Hat Bugzilla).

Users should upgrade LibreOffice to version 25.8.7 or later (for the 25.8 series) or 26.2.3 or later (for the 26.2 series), as these versions include the type-check fix. As a workaround, users should exercise caution when opening DOCX files from untrusted sources and consider disabling OOXML document import if it is not required for business operations. Organizations should prioritize patching endpoints running affected LibreOffice versions (GitHub Advisory, LibreOffice Advisory).

Red Hat has tracked the vulnerability via its Bugzilla system, classifying it as medium severity and assigning it to the Product Security DevOps Team for response. The GitHub Advisory Database published the advisory on June 15, 2026, rating it as "Moderate." No significant public researcher commentary or broad media coverage has been identified at this time (Red Hat Bugzilla, GitHub Advisory).