CVE-2026-8357: LibreOffice Calc Heap Buffer Overflow in Formula Compilation

Technical summary

CVE-2026-8357 is a heap buffer overflow in LibreOffice Calc's formula compilation logic. The vulnerability stems from an off-by-one allocation error in the array that tracks operator nesting depth during formula parsing. When a formula contains a number of opening tokens that reaches the theoretical maximum nesting level, the write operation exceeds the allocated buffer by one element. The flaw is classified under CWE-131 (Incorrect Buffer Size Calculation), CWE-193 (Off-by-one Error), and CWE-787 (Out-of-bounds Write). The fix involves resizing the nesting depth tracking array to accommodate the worst-case nesting scenario.

Business impact

This vulnerability poses a significant risk to organizations that use LibreOffice Calc for financial modeling, data analysis, or any spreadsheet-based workflows. Attackers can craft malicious .ods, .xlsx, or other spreadsheet files that trigger the overflow upon opening, potentially achieving code execution with the privileges of the user running LibreOffice. For businesses relying on shared spreadsheet repositories or email-based document exchange, the attack surface is considerable. Depending on user privileges and system configuration, successful exploitation could lead to data theft, lateral movement within networks, or system compromise.

Affected systems

LibreOffice Calc versions prior to the patched release are affected. The vulnerability is triggered during file opening when the formula compilation engine processes unusually long, deeply nested formulas. All platforms running vulnerable LibreOffice Calc builds—including Windows, macOS, and Linux—are susceptible. The vulnerability requires user interaction (opening a file), meaning headless or server-side deployments of Calc are not at risk unless automated processes open untrusted spreadsheets.

Exploitability

The attack requires moderate complexity: an attacker must craft a spreadsheet with a specifically structured formula that triggers maximum nesting depth. However, the barrier to entry is low because the malicious file simply needs to be opened by a victim—no special application features or user configuration is required. The CVSS score of 7.8 (HIGH) reflects this balance: no elevated privileges needed, local attack vector, and complete impact across confidentiality, integrity, and availability if code execution is achieved. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog, but the straightforward nature of the trigger makes it a plausible target for future weaponization.

Remediation

Apply the patched version of LibreOffice Calc released after 2026-06-15. Verify the patch version against the official LibreOffice project security advisory. Until patching is possible, implement application whitelisting to restrict Calc execution, use email gateway controls to block suspicious spreadsheet attachments, and educate users to avoid opening spreadsheets from untrusted sources. Consider disabling automatic formula calculation in Calc if your workflows permit.

Patch guidance

Consult the official LibreOffice security advisory for the specific patched version number applicable to your deployment (ESC or stable branch). Patch versions are typically released concurrently across all supported major versions (e.g., 7.x, 8.x, and latest). Test patches in a non-production environment before broad rollout, particularly if your organization uses custom spreadsheet macros or extensions that might be affected by changes to formula compilation.

Detection guidance

Monitor for unexpected Calc process crashes or memory corruption symptoms when users open spreadsheets from external sources. Endpoint Detection and Response (EDR) tools should alert on unusual heap activity or code execution stemming from Calc's process. Network-based detection is limited since the trigger occurs during local file parsing; focus on preventing suspicious spreadsheet files from reaching users via email filtering and content inspection. Log any Calc crashes with attached spreadsheet file names and hashes for forensic correlation.

Why prioritize this

This vulnerability merits immediate attention despite its lack of KEV status. The high CVSS score (7.8), combined with the low bar for triggering the flaw (any file opened by a user), creates substantial organizational risk. Spreadsheets are ubiquitous in enterprise environments, and users routinely open files from email and shared repositories. The straightforward nature of the exploit—embedding a specially crafted formula—makes this an attractive vector for targeted or mass-distribution attacks. Prioritize patching of systems where users receive external spreadsheets or where Calc is used for sensitive financial or engineering calculations.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a HIGH severity rating driven by: (1) Local attack vector with user interaction (file opening), (2) Low complexity once a malicious file is crafted, (3) No privilege escalation required, (4) Complete impact on confidentiality, integrity, and availability through heap corruption and potential code execution. The score does not assume network propagation; however, via email or file-sharing platforms, the attack surface is effectively broad. The absence of a CISA KEV listing does not diminish the intrinsic risk—it simply indicates no active exploitation has been formally documented at the time of this analysis.

Frequently asked questions