LibreOffice Calc Heap Buffer Overflow via Malformed Formula (<26.2.4)
CVE-2026-8357 Published on June 15, 2026
Heap buffer overflow in Calc formula compilation
LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.
Vulnerability Analysis
CVE-2026-8357 can be exploited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Types
What is a Memory Corruption Vulnerability?
The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CVE-2026-8357 has been classified to as a Memory Corruption vulnerability or weakness.
What is an off-by-five Vulnerability?
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVE-2026-8357 has been classified to as an off-by-five vulnerability or weakness.
Incorrect Calculation of Buffer Size
The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
Products Associated with CVE-2026-8357
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-8357 are published in these products:
Affected Versions
The Document Foundation LibreOffice:- Version 26.2 and below < 26.2.4 is affected.
- Version 1:5.3.6.1-28.el7_9 and below * is unaffected.
- Version 1:6.4.7.2-21.el8_10 and below * is unaffected.
- Version 1:6.4.7.2-18.el8_4.2 and below * is unaffected.
- Version 1:6.4.7.2-18.el8_4.2 and below * is unaffected.
- Version 1:6.4.7.2-18.el8_6.2 and below * is unaffected.
- Version 1:6.4.7.2-18.el8_6.2 and below * is unaffected.
- Version 1:6.4.7.2-18.el8_8.2 and below * is unaffected.
- Version 1:6.4.7.2-18.el8_8.2 and below * is unaffected.
- Version 1:7.1.8.1-15.el9_8.2 and below * is unaffected.
- Version 1:7.1.8.1-14.el9_2.2 and below * is unaffected.
- Version 1:7.1.8.1-15.el9_4.2 and below * is unaffected.
- Version 1:7.1.8.1-15.el9_6.2 and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.