Summary
Duc Anh Nguyen discovered that LibreOffice incorrectly handled mismatched
encryption salt parameters in crafted OOXML documents. An attacker could
use this issue to cause LibreOffice to crash, resulting in a denial of
service, or possibly execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.11 |
| Ubuntu · 24.04 LTS 24.04:LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.5 |
Vulnerabilities 1
-
Medium 5.4
Heap Buffer Overflow in AgileEngine
Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.
References
-
report
https://ubuntu.com/security/CVE-2026-4430