CVE-2026-8358

A heap-based buffer overflow vulnerability was discovered in LibreOffice Calc's spreadsheet importer. When processing tracked changes from a spreadsheet document, the application fails to properly handle duplicate change identifiers. By reusing the same change identifier for two distinct types of change objects, a maliciously crafted document can trick the importer into treating a change object as a different, larger data type than originally allocated. This mismatch causes the importer to write data past the boundaries of the allocated heap buffer, which could result in a denial of service (application crash) or limited impacts to confidentiality and integrity under the privileges of the current user.

This vulnerability affects LibreOffice Calc's tracked-changes import functionality. Red Hat Product Security has assessed this issue as a Moderate severity vulnerability.

The flaw occurs when importing spreadsheet documents containing tracked-change records that reuse the same change identifier for different change types. Under these conditions, the importer may incorrectly treat a change object as a different, larger object type and write beyond the bounds of the allocated heap buffer.

Successful exploitation requires a user to open a specially crafted spreadsheet document. A remote attacker could leverage this issue to cause application crashes resulting in denial of service and potentially achieve limited disclosure or modification of data within the context of the affected application.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.