CVE-2026-76181: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-76181 is a heap buffer overflow and uncontrolled recursion vulnerability in LibreOffice's dBASE database driver. When a folder of dBASE files is used as a data source, the driver reads .ndx index files without validating the number of entries recorded in a page against the page's actual capacity, enabling a heap buffer overflow. Additionally, a crafted index can create circular page references that trigger infinite recursion. Affected versions include LibreOffice 26.2 series before 26.2.6 and 26.8 series before 26.8.1, developed by The Document Foundation. The vulnerability was published on November 5, 2026, with a CVSS v3.1 score of 6.6 (Medium) and a CVSS v4.0 score of 5.4 (Medium) (GitHub Advisory).

The vulnerability is classified under CWE-787 (Out-of-bounds Write) and CWE-674 (Uncontrolled Recursion). The root cause is twofold: first, the dBASE driver fails to cross-validate the entry count recorded within an index page against the maximum entries the page can hold (derived from a separate field in the index header), allowing a crafted .ndx file to trigger a heap buffer overflow during page parsing. Second, the driver does not detect or prevent circular page references, where a page refers back to itself or an ancestor, causing unbounded recursive reads. Exploitation requires a local attacker to deliver a maliciously crafted dBASE index file and have the victim open it in LibreOffice (GitHub Advisory).

Successful exploitation can result in arbitrary code execution, unauthorized memory reads (confidentiality impact), limited data modification (integrity impact), or a crash of the LibreOffice application (high availability impact). The scope is limited to the vulnerable system — no subsequent system impact is expected. The primary risk is to end-user workstations where LibreOffice is used to open untrusted dBASE database files, with potential for code execution in the context of the logged-in user (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The CVSS v4.0 exploit maturity is rated "Proof of Concept," though no actual PoC has been publicly released. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction (opening a crafted file) and local access, limiting the attack surface.

1. Craft malicious dBASE index file: Create a .ndx index file where the entry count field in an index page is set to a value exceeding the page's actual capacity, or configure a page to reference itself or a parent page to trigger circular recursion.
2. Deliver the file to the target: Use social engineering, phishing, or a shared network folder to place the crafted .dbf/.ndx files in a location accessible to the victim, or package them in an archive sent via email.
3. Induce victim to open the data source: Convince the victim to open the folder of dBASE files as a data source in LibreOffice (e.g., via Base or a document referencing the dBASE folder), triggering the driver to parse the malicious .ndx file.
4. Trigger heap buffer overflow or infinite recursion: The dBASE driver reads the crafted index page without bounds checking, causing a heap buffer overflow (potentially enabling code execution) or entering infinite recursion (causing a crash/denial of service).
5. Achieve objective: Depending on heap layout and exploitation sophistication, the attacker may achieve arbitrary code execution in the context of the LibreOffice process, or at minimum crash the application.

• File System: Unexpected .ndx or .dbf files in user download directories, temporary folders, or shared drives, particularly with anomalous file sizes or metadata inconsistent with legitimate dBASE databases.
• Process: LibreOffice (soffice.bin / soffice.exe) crashing unexpectedly or consuming excessive CPU/memory when opening a dBASE data source; child processes spawned unexpectedly from the LibreOffice process.
• Logs: Application crash reports or core dumps referencing LibreOffice's dBASE driver components; Windows Event Log or Linux system logs showing abnormal termination of LibreOffice processes.
• Network: Unexpected outbound network connections from the LibreOffice process following the opening of a dBASE file (potential indicator of post-exploitation activity).

Update LibreOffice to version 26.2.6 or later (for the 26.2 series) or 26.8.1 or later (for the 26.8 series), which validate index header entry counts against page capacity limits and prevent circular page references (GitHub Advisory). As an interim workaround, avoid opening dBASE database files (.dbf and .ndx) from untrusted or unknown sources. Organizations that do not require dBASE database functionality should consider disabling the dBASE database driver in LibreOffice until patching is complete.