CVE-2026-8357: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-8357 is a heap buffer overflow vulnerability in LibreOffice Calc's formula compilation engine, allowing potential arbitrary code execution when a user opens a maliciously crafted spreadsheet. The flaw affects LibreOffice versions in the 26.2 series prior to 26.2.4, developed by The Document Foundation, and also impacts Red Hat Enterprise Linux 6, 7, 8, and 9 distributions shipping the affected package. It was published on June 15, 2026, with a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 5.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an off-by-one error (CWE-193) combined with an incorrect buffer size calculation (CWE-131) in LibreOffice Calc's formula compiler, resulting in an out-of-bounds write (CWE-787). When Calc compiles a cell formula containing an exceptionally long sequence of opening tokens (e.g., deeply nested parentheses or function calls), it uses an internal array to track nesting depth. This array was allocated one element too small for the worst-case nesting depth, causing the compiler to write one element past the end of the heap buffer. Exploitation requires a user to open a specially crafted spreadsheet file — no privileges are required on the attacker's side, but user interaction is necessary (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the LibreOffice process on the victim's system, impacting confidentiality, integrity, and availability. The attack is local in vector, meaning the malicious spreadsheet must be opened by the target user, but delivery via email attachment, download, or shared network drive is a realistic scenario. Heap corruption from the out-of-bounds write may also result in application crashes (denial of service) even if code execution is not achieved (GitHub Advisory, Red Hat Bugzilla).

As of the time of reporting, there is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit, though the CVSS v4.0 exploit maturity is rated as "Proof of Concept" in the scoring metadata. The EPSS score is approximately 0.119% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" at this time (GitHub Advisory, Red Hat Bugzilla).

1. Craft malicious spreadsheet: Create a .ods or .xlsx spreadsheet file containing a cell formula with an extremely long sequence of opening tokens (e.g., deeply nested function calls or parentheses) designed to exceed the maximum nesting depth tracked by LibreOffice Calc's internal array.
2. Deliver the file: Distribute the malicious spreadsheet to the target via email attachment, a download link, a shared network drive, or other social engineering methods to induce the victim to open it.
3. Trigger formula compilation: When the victim opens the file in LibreOffice Calc, the application automatically compiles all cell formulas. The malicious formula triggers the off-by-one heap buffer overflow, writing one element past the end of the nesting-depth tracking array.
4. Achieve heap corruption: The out-of-bounds write corrupts adjacent heap memory, potentially overwriting function pointers, object metadata, or other control structures depending on heap layout.
5. Execute arbitrary code: With a sufficiently crafted payload and heap grooming, an attacker may redirect execution flow to attacker-controlled code, running it with the privileges of the LibreOffice process on the victim's system (GitHub Advisory, Red Hat Bugzilla).

• File System: Presence of unexpected .ods, .xlsx, or .xls files with unusually large or deeply nested formula strings in cell data; new or modified files in the user's home directory or temp folders shortly after opening a spreadsheet.
• Process: LibreOffice (soffice, soffice.bin) spawning unexpected child processes (e.g., shells, curl, wget, python, bash) or making unusual outbound network connections.
• Logs: Application crash logs or core dumps associated with the LibreOffice process (soffice), particularly referencing heap corruption or segmentation faults during formula compilation; entries in system logs (/var/log/syslog, journalctl) showing abnormal LibreOffice termination.
• Network: Unexpected outbound connections from the LibreOffice process to external IP addresses or domains, which may indicate post-exploitation activity such as reverse shell establishment or data exfiltration.

Users should upgrade LibreOffice to version 26.2.4 or later, which sizes the nesting-depth tracking array to accommodate the largest possible nesting depth, eliminating the off-by-one overflow. As interim workarounds, organizations should restrict opening spreadsheet files from untrusted sources, disable automatic opening of email attachments in LibreOffice, and consider using sandboxed or isolated environments for processing spreadsheets of unknown origin. Red Hat Enterprise Linux users should monitor Red Hat advisories for updated packages addressing this CVE (LibreOffice Advisory, Red Hat Bugzilla).

The vulnerability was credited to Anthropic in a GitHub repository tracking Anthropic-credited CVEs, suggesting it was discovered through AI-assisted security research (GitHub Advisory). No significant vendor statements beyond the official LibreOffice advisory or notable researcher commentary have been identified at this time.