CVE-2026-6040

libreoffice: LibreOffice: Heap use-after-free allows arbitrary code execution via malformed ODF number format

Loading…

Severity

Important

Red Hat Product Security

7.3

CVSS 3.1

Review impact separately from score.

Published · June 16, 2026

Updated · November 5, 2026

Description

A vulnerability was found in LibreOffice. If a user inadvertently opens a malicious OpenDocument Format (ODF) file, an attacker could execute unauthorized code and potentially gain full control of the system.

Statement

This LibreOffice vulnerability is rated as Important. If a user inadvertently opens a maliciously crafted OpenDocument Format (ODF) file, an attacker can execute unauthorized code, potentially resulting in complete control over the affected system.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Users should exercise caution and avoid opening untrusted OpenDocument Format (ODF) files.

CVSS / CWE

CVSS 3.1 · 7.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-825 · Expired Pointer Dereference