CVE-2026-8356: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-8356 is a stack-based buffer overflow vulnerability in LibreOffice's legacy binary PPT format importer that can lead to denial of service or potential arbitrary code execution. It affects LibreOffice version 26.2 up to (but not including) 26.2.4, as maintained by The Document Foundation. The vulnerability was published on June 15, 2026, with a patch available in version 26.2.4. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 5.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incorrect calculation of buffer size (CWE-131) leading to a stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787) during PPT file parsing. When LibreOffice imports a colour-replacement record from a legacy binary PPT file, two fixed-size colour tables on the stack are populated in two passes over the record; however, the write position is not reset between passes. If the combined colour count across both passes exceeds the allocated table size, data is written past the end of the stack-allocated tables. Exploitation requires a user to open a specially crafted PPT file, making user interaction a necessary precondition (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation of this vulnerability can cause a denial of service by crashing the LibreOffice process due to stack memory corruption. In more severe scenarios, the stack buffer overflow could potentially be leveraged to execute arbitrary code with the privileges of the LibreOffice process, affecting confidentiality and integrity of data accessible to that process. The impact is limited to the local system where the malicious PPT file is opened, with no direct lateral movement capability, though code execution could enable further attacker actions on the compromised host (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit. The CVSS v4.0 exploit maturity is rated as "Proof of Concept," though no specific PoC has been confirmed publicly. The EPSS score is approximately 0.119% (2nd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Craft a malicious PPT file: Create a legacy binary PPT file containing a colour-replacement record where the combined colour counts across both passes exceed the fixed-size colour table allocated on the stack.
2. Deliver the file to the target: Use social engineering, phishing email, or a malicious download link to deliver the crafted .ppt file to a user running a vulnerable version of LibreOffice (26.2.x before 26.2.4).
3. Induce the victim to open the file: Persuade the target user to open the file in LibreOffice Impress or another LibreOffice component capable of importing PPT files.
4. Trigger the buffer overflow: Upon import, LibreOffice processes the colour-replacement record without resetting the write position between the two passes, causing data to be written past the end of the stack-allocated colour tables.
5. Achieve denial of service or code execution: The out-of-bounds stack write corrupts adjacent stack memory, leading to a crash (DoS) or, with a carefully crafted payload, potential arbitrary code execution with the privileges of the LibreOffice process (GitHub Advisory).

• File System: Presence of unexpected or unsolicited .ppt files in user download directories, email attachments, or shared drives; files with anomalously large or malformed colour-replacement records detectable via binary inspection.
• Process: LibreOffice process (soffice, soffice.bin) crashing unexpectedly or generating core dump files after opening a PPT file; unusual child processes spawned by LibreOffice following file open events.
• Logs: Application crash logs or system logs (e.g., /var/log/syslog, Windows Event Viewer) recording LibreOffice segmentation faults or access violations coinciding with PPT file import operations; crash reporter dialogs or minidump files associated with LibreOffice.

The Document Foundation has released LibreOffice 26.2.4, which fixes this vulnerability by eliminating the unused second pass that wrote into the colour tables, preventing the out-of-bounds write. Users should update to LibreOffice 26.2.4 or later as the primary remediation. As an interim workaround, organizations should restrict users from opening untrusted PPT files, disable legacy PPT format support if not required, and exercise caution with PPT files received from unknown sources (GitHub Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via their Bugzilla system (Bug 2488961), classifying it as medium severity and noting it as a denial-of-service issue via specially crafted PPT files. The GitHub Advisory Database published the advisory on June 15, 2026, with a moderate severity rating. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been identified at this time (Red Hat Bugzilla, GitHub Advisory).