Summary
Duc Anh Nguyen discovered that LibreOffice incorrectly handled mismatched
encryption salt parameters in crafted OOXML documents. An attacker could
use this issue to cause LibreOffice to crash, resulting in a denial of
service, or possibly execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 25.10 | libreoffice | 4:25.8.7-0ubuntu0.25.10.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | libreoffice | 4:26.2.3.2-0ubuntu0.26.04.1 |
Vulnerabilities 1
-
Medium 5.4
Heap Buffer Overflow in AgileEngine
Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.
References
-
report
https://ubuntu.com/security/CVE-2026-4430