CVE-2026-6040: ODF Number Format Heap Use-After-Free Vulnerability

Technical summary

The vulnerability stems from insufficient bounds checking during ODF number format import. The affected code processes position values from document-embedded format strings without validating that the position falls within the actual length of the format-code string. This allows out-of-bounds memory access. The flaw is classified as a heap use-after-free (CWE-416), with contributing issues in buffer over-read (CWE-787) and improper pointer validation (CWE-825). Fixed versions introduce explicit bounds checking to ensure position values cannot exceed the format-code string length, preventing out-of-bounds access.

Business impact

Exploitation requires a user to open a crafted ODF document, making this a file-based attack vector suitable for targeted spear-phishing or malicious document distribution. Successful exploitation can lead to confidentiality breaches (reading sensitive heap memory), integrity violations (potential data corruption), or availability disruption (application crash). Organizations handling sensitive spreadsheets, presentations, or text documents in ODF format face elevated risk, particularly if users are exposed to untrusted sources or if document collaboration workflows are not tightly controlled.

Affected systems

No specific vendor or product information was disclosed in the source data. However, the vulnerability affects ODF number format parsing, which is primarily found in office productivity suites and document processing applications that support ODF standards. Administrators should consult vendor advisories and the KEV catalog for definitive product lists and version ranges. Verify against the vendor advisory to determine which applications and versions are affected.

Exploitability

The attack requires local access and user interaction—a user must open a malicious ODF file. The CVSS 3.1 score of 7.3 (HIGH) reflects that while the impact severity is high (confidentiality, integrity, and availability all affected), the barrier to exploitation is moderate due to these prerequisites. No known public exploits or KEV inclusion suggest active in-the-wild exploitation at time of publication, but the simplicity of crafting a malicious ODF file and the reliance on social engineering make this a credible practical threat.

Remediation

Apply patches from your ODF-supporting software vendor as they become available. Patches address the vulnerability by adding bounds checking to validate position values before they are used to index into format-code strings. Until patches are deployed, mitigate risk by restricting ODF document sources, disabling automatic document opening from untrusted channels, and educating users to avoid opening unsolicited ODF files.

Patch guidance

Monitor vendor security advisories and apply patches to all ODF-capable applications in your environment—especially those handling user-supplied or externally sourced documents. Verify against the vendor advisory for exact patch versions and deployment timelines. Test patches in a controlled environment before production rollout to ensure compatibility with your document workflows. Prioritize systems where users frequently receive documents from external parties.

Detection guidance

Application crashes or unexpected memory behavior when opening ODF documents may signal exploitation attempts. Log and alert on document parsing failures in ODF-capable applications. Consider file-integrity monitoring on shared document repositories. Network and endpoint detection should flag suspicious ODF files with malformed number formats, though signature-based detection is challenging without vendor-provided indicators. In the near term, behavioral monitoring for application crashes triggered by ODF imports offers the most practical signal.

Why prioritize this

Score 7.3 (HIGH) and user-interaction dependency warrant rapid but not emergency patching. The vulnerability affects document processing, a ubiquitous use case; organizations handling external documents or relying on ODF workflows should prioritize this. The absence of KEV designation and active exploitation reports allows a measured deployment timeline, but patches should not be deferred indefinitely. High-risk organizations handling sensitive document collections should patch within 30 days; others within 60 days.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a high-impact vulnerability (C:H, I:H, A:H) requiring local access and user interaction. The combination of heap corruption potential and reliance on social engineering to trigger the flaw lands it in the HIGH range. It is not CRITICAL because it requires user action and local access, not network propagation. The score appropriately signals that patching is important but allows time for staged deployment and testing.

Frequently asked questions