Description
LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Document Foundation | LibreOffice | 26.2 – < < 26.2.4 | < 26.2.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libreoffice | 4:26.2.4.2-1 | — |
| Debian 13 | libreoffice | 4:25.2.3-2+deb13u5 | — |
| Debian 12 | libreoffice | 4:7.4.7-1+deb12u13 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libreoffice | 4:26.2.4.2-0ubuntu0.26.04.2 | USN-8534-1 |
| Ubuntu 25.10 | libreoffice | No fix yet | — |
| Ubuntu 24.04 LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.6 | USN-8534-1 |
| Ubuntu 22.04 LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.12 | USN-8534-1 |
| Ubuntu 20.04 LTS | libreoffice | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libreoffice | 26.2.5.1-150500.20.37.1 | SUSE-SU-2026:3140-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | libreoffice | 26.8.1.1-bp160.1.1 | openSUSE-SU-2026:22216-1 |
Advisories 4
- openSUSE-SU-2026:22216-1 Security update for libreoffice SUSE / openSUSE Security Updates · Nov 4, 2026
- WID-SEC-2026-1929 LibreOffice: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Nov 3, 2026
- SUSE-SU-2026:3140-1 Security update for libreoffice SUSE / openSUSE Security Updates · Jul 21, 2026
- USN-8534-1 libreoffice vulnerabilities Ubuntu Security Notices (USN) · Jul 14, 2026