Skip to content
Fencer Vulns
high 7.8

CVE-2026-8357 json

Heap buffer overflow in Calc formula compilation

published 2026-06-15 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-36739

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits
0
none known

Summary

LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.

Patch / fix

  • The Document Foundation LibreOffice < 26.2.4
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 1:5.3.6.1-28.el7_9
  • Red Hat Red Hat Enterprise Linux 8 1:6.4.7.2-21.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 1:6.4.7.2-18.el8_4.2
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 1:6.4.7.2-18.el8_4.2
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 1:6.4.7.2-18.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 1:6.4.7.2-18.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 1:6.4.7.2-18.el8_8.2
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 1:6.4.7.2-18.el8_8.2
  • Red Hat Red Hat Enterprise Linux 9 1:7.1.8.1-15.el9_8.2
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 1:7.1.8.1-14.el9_2.2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 1:7.1.8.1-15.el9_4.2
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 1:7.1.8.1-15.el9_6.2
  • libreoffice Debian 12 4:7.4.7-1+deb12u13
  • libreoffice Debian 13 4:25.2.3-2+deb13u5
  • libreoffice Debian 14 4:26.2.4.2-1

debian advisories DEBIAN-CVE-2026-8357

  • libreoffice Ubuntu 22.04 LTS 1:7.3.7-0ubuntu0.22.04.12
  • libreoffice Ubuntu 24.04 LTS 4:24.2.7-0ubuntu0.24.04.6
  • libreoffice Ubuntu 26.04 LTS 4:26.2.4.2-0ubuntu0.26.04.2

ubuntu advisories UBUNTU-CVE-2026-8357

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libreoffice RHEL 9 1:7.1.8.1-15.el9_8.2
  • autocorr-af RHEL 9 1:7.1.8.1-15.el9_8.2
  • autocorr-bg RHEL 9 1:7.1.8.1-15.el9_8.2
  • autocorr-ca RHEL 9 1:7.1.8.1-15.el9_8.2
  • autocorr-cs RHEL 9 1:7.1.8.1-15.el9_8.2
  • autocorr-da RHEL 9 1:7.1.8.1-15.el9_8.2
  • autocorr-de RHEL 9 1:7.1.8.1-15.el9_8.2
  • autocorr-el RHEL 9 1:7.1.8.1-15.el9_8.2

red hat advisories RHSA-2026:46386RHSA-2026:46387RHSA-2026:43460RHSA-2026:43461RHSA-2026:43424RHSA-2026:43425

  • libreoffice SLE Workstation Extension 15 SP7, SLE Module for Package Hub 15 SP7 26.2.5.1-150500.20.37.1

suse advisories SUSE-SU-2026:3140-1

  • libreoffice openSUSE Leap 16.0 26.8.1.1-bp160.1.1

opensuse advisories openSUSE-SU-2026:22216-1

  • libreoffice AlmaLinux 9 1:7.1.8.1-15.el9_8.2.alma.1
  • autocorr-af AlmaLinux 9 1:7.1.8.1-15.el9_8.2.alma.1
  • autocorr-bg AlmaLinux 9 1:7.1.8.1-15.el9_8.2.alma.1
  • autocorr-ca AlmaLinux 9 1:7.1.8.1-15.el9_8.2.alma.1
  • autocorr-cs AlmaLinux 9 1:7.1.8.1-15.el9_8.2.alma.1
  • autocorr-da AlmaLinux 9 1:7.1.8.1-15.el9_8.2.alma.1
  • autocorr-de AlmaLinux 9 1:7.1.8.1-15.el9_8.2.alma.1
  • autocorr-el AlmaLinux 9 1:7.1.8.1-15.el9_8.2.alma.1

almalinux advisories ALSA-2026:36832ALSA-2026:35839

  • libreoffice Rocky Linux 9 1:7.1.8.1-15.el9_8.2
  • libreoffice Rocky Linux 8 1:6.4.7.2-21.el8_10

rocky linux advisories RLSA-2026:36832RLSA-2026:35839

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-8357 updated cvss 7.8

libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation

  • Red Hat Enterprise Linux 6 autocorr-af, autocorr-bg, autocorr-ca, autocorr-cs, autocorr-da, autocorr-de, +60 more
    affected: workaround, no fix planned “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.”
  • Red Hat CodeReady Linux Builder EUS (v.9.6) libreoffice-sdk 7.1.8.1-15.el9_6.2
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:43425
  • Red Hat Enterprise Linux AppStream (v. 8) autocorr-af 6.4.7.2-21.el8_10, autocorr-bg 6.4.7.2-21.el8_10, autocorr-ca 6.4.7.2-21.el8_10, autocorr-cs 6.4.7.2-21.el8_10, autocorr-da 6.4.7.2-21.el8_10, autocorr-de 6.4.7.2-21.el8_10, +95 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:35839
  • Red Hat Enterprise Linux AppStream (v. 9) autocorr-af 7.1.8.1-15.el9_8.2, autocorr-bg 7.1.8.1-15.el9_8.2, autocorr-ca 7.1.8.1-15.el9_8.2, autocorr-cs 7.1.8.1-15.el9_8.2, autocorr-da 7.1.8.1-15.el9_8.2, autocorr-de 7.1.8.1-15.el9_8.2, +100 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:36832
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) autocorr-af 6.4.7.2-18.el8_4.2, autocorr-bg 6.4.7.2-18.el8_4.2, autocorr-ca 6.4.7.2-18.el8_4.2, autocorr-cs 6.4.7.2-18.el8_4.2, autocorr-da 6.4.7.2-18.el8_4.2, autocorr-de 6.4.7.2-18.el8_4.2, +95 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:46387
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) autocorr-af 6.4.7.2-18.el8_6.2, autocorr-bg 6.4.7.2-18.el8_6.2, autocorr-ca 6.4.7.2-18.el8_6.2, autocorr-cs 6.4.7.2-18.el8_6.2, autocorr-da 6.4.7.2-18.el8_6.2, autocorr-de 6.4.7.2-18.el8_6.2, +95 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:43461
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) autocorr-af 6.4.7.2-18.el8_8.2, autocorr-bg 6.4.7.2-18.el8_8.2, autocorr-ca 6.4.7.2-18.el8_8.2, autocorr-cs 6.4.7.2-18.el8_8.2, autocorr-da 6.4.7.2-18.el8_8.2, autocorr-de 6.4.7.2-18.el8_8.2, +95 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:43460
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) autocorr-af 7.1.8.1-14.el9_2.2, autocorr-bg 7.1.8.1-14.el9_2.2, autocorr-ca 7.1.8.1-14.el9_2.2, autocorr-cs 7.1.8.1-14.el9_2.2, autocorr-da 7.1.8.1-14.el9_2.2, autocorr-de 7.1.8.1-14.el9_2.2, +100 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:43423
show 8 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) autocorr-af 7.1.8.1-15.el9_4.2, autocorr-bg 7.1.8.1-15.el9_4.2, autocorr-ca 7.1.8.1-15.el9_4.2, autocorr-cs 7.1.8.1-15.el9_4.2, autocorr-da 7.1.8.1-15.el9_4.2, autocorr-de 7.1.8.1-15.el9_4.2, +100 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:43424
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) autocorr-af 7.1.8.1-15.el9_6.2, autocorr-bg 7.1.8.1-15.el9_6.2, autocorr-ca 7.1.8.1-15.el9_6.2, autocorr-cs 7.1.8.1-15.el9_6.2, autocorr-da 7.1.8.1-15.el9_6.2, autocorr-de 7.1.8.1-15.el9_6.2, +100 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:43425
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) autocorr-af 6.4.7.2-18.el8_4.2, autocorr-bg 6.4.7.2-18.el8_4.2, autocorr-ca 6.4.7.2-18.el8_4.2, autocorr-cs 6.4.7.2-18.el8_4.2, autocorr-da 6.4.7.2-18.el8_4.2, autocorr-de 6.4.7.2-18.el8_4.2, +95 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:46387
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) autocorr-af 6.4.7.2-18.el8_6.2, autocorr-bg 6.4.7.2-18.el8_6.2, autocorr-ca 6.4.7.2-18.el8_6.2, autocorr-cs 6.4.7.2-18.el8_6.2, autocorr-da 6.4.7.2-18.el8_6.2, autocorr-de 6.4.7.2-18.el8_6.2, +95 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:43461
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) autocorr-af 6.4.7.2-18.el8_8.2, autocorr-bg 6.4.7.2-18.el8_8.2, autocorr-ca 6.4.7.2-18.el8_8.2, autocorr-cs 6.4.7.2-18.el8_8.2, autocorr-da 6.4.7.2-18.el8_8.2, autocorr-de 6.4.7.2-18.el8_8.2, +95 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:43460
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libreoffice-sdk 7.1.8.1-15.el9_8.2
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:36832
  • Red Hat Enterprise Linux CRB (v. 8) libreoffice-sdk 6.4.7.2-21.el8_10
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:35839
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS) autocorr-af 5.3.6.1-28.el7_9, autocorr-bg 5.3.6.1-28.el7_9, autocorr-ca 5.3.6.1-28.el7_9, autocorr-cs 5.3.6.1-28.el7_9, autocorr-da 5.3.6.1-28.el7_9, autocorr-de 5.3.6.1-28.el7_9, +104 more
    fixed: vendor fix “Users should exercise caution when opening untrusted or suspicious spreadsheet documents.” RHSA-2026:46386

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 4.0 5.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • The Document Foundation LibreOffice
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.