CVE-2026-76181

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76181", "assignerOrgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "state": "PUBLISHED", "assignerShortName": "Document Fdn.", "dateReserved": "2026-08-19T10:32:49.720Z", "datePublished": "2026-11-05T19:57:48.043Z", "dateUpdated": "2026-11-05T20:19:49.628Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "shortName": "Document Fdn.", "dateUpdated": "2026-11-05T19:57:48.043Z"}, "title": "Heap buffer overflow in dBASE index import", "datePublic": "2026-11-05T23:59:00.000Z", "descriptions": [{"lang": "en", "value": "LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source.</p><p>A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end.</p><p>In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.</p>"}]}], "affected": [{"vendor": "The Document Foundation", "product": "LibreOffice", "defaultStatus": "unknown", "versions": [{"status": "affected", "version": "26.2", "lessThan": "< 26.2.6", "versionType": "26.2 series"}, {"status": "affected", "version": "26.8", "lessThan": "< 26.8.1", "versionType": "26.8 series"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Claude, found by Anthropic using agents to study the security of open-source projects"}, {"lang": "en", "type": "analyst", "value": "Ada Logics, validating and reporting"}, {"lang": "en", "type": "finder", "value": "Anonymous working with TrendAI Zero Day Initiative"}, {"lang": "en", "type": "remediation developer", "value": "Caol\u00e1n McNamara of Collabora Productivity"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-44", "descriptions": [{"lang": "en", "value": "CAPEC-44 Overflow Binary Resource File"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P"}}], "references": [{"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-76181"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:19:33.387362Z", "id": "CVE-2026-76181", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:19:49.628Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-76181", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T20:19:33.387362Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:16:18.705Z"}}], "cna": {"title": "Heap buffer overflow in dBASE index import", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Claude, found by Anthropic using agents to study the security of open-source projects"}, {"lang": "en", "type": "analyst", "value": "Ada Logics, validating and reporting"}, {"lang": "en", "type": "finder", "value": "Anonymous working with TrendAI Zero Day Initiative"}, {"lang": "en", "type": "remediation developer", "value": "Caol\u00e1n McNamara of Collabora Productivity"}], "impacts": [{"capecId": "CAPEC-44", "descriptions": [{"lang": "en", "value": "CAPEC-44 Overflow Binary Resource File"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Document Foundation", "product": "LibreOffice", "versions": [{"status": "affected", "version": "26.2", "lessThan": "< 26.2.6", "versionType": "26.2 series"}, {"status": "affected", "version": "26.8", "lessThan": "< 26.8.1", "versionType": "26.8 series"}], "defaultStatus": "unknown"}], "datePublic": "2026-11-05T23:59:00.000Z", "references": [{"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-76181"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.", "supportingMedia": [{"type": "text/html", "value": "<p>LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source.</p><p>A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end.</p><p>In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "shortName": "Document Fdn.", "dateUpdated": "2026-11-05T19:57:48.043Z"}}}, "cveMetadata": {"cveId": "CVE-2026-76181", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:19:49.628Z", "dateReserved": "2026-08-19T10:32:49.720Z", "assignerOrgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "datePublished": "2026-11-05T19:57:48.043Z", "assignerShortName": "Document Fdn."}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "LibreOffice", "vendor": "The Document Foundation", "versions": [{"lessThan": "< 26.2.6", "status": "affected", "version": "26.2", "versionType": "26.2 series"}, {"lessThan": "< 26.8.1", "status": "affected", "version": "26.8", "versionType": "26.8 series"}]}], "source": "security@documentfoundation.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed."}], "id": "CVE-2026-76181", "lastModified": "2026-11-12T20:04:52.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@documentfoundation.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76181", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:19:33.387362Z", "version": "2.0.3"}}]}, "published": "2026-11-05T20:17:59.693", "references": [{"source": "security@documentfoundation.org", "url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-76181"}], "sourceIdentifier": "security@documentfoundation.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}, {"lang": "en", "value": "CWE-787"}], "source": "security@documentfoundation.org", "type": "Secondary"}]}

{"bugzilla": {"description": "libreoffice: libreoffice: Denial of Service via crafted dBASE index file", "id": "2567877", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567877"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in LibreOffice. The application's dBASE database driver fails to validate entry counts against page capacity and does not prevent circular page references when parsing index (.ndx) files. By convincing a user to open a data source with a specially crafted dBASE index file, an attacker can trigger infinite recursion or a heap-based buffer overflow. This primarily leads to an application crash resulting in a Denial of Service (DoS) and may potentially cause memory corruption."], "mitigation": {"lang": "en:us", "value": "Avoid opening or connecting to untrusted dBASE tables and associated index files (.ndx). On systems where LibreOffice productivity software is not required, remove the packages to eliminate the attack surface.\nTo remove LibreOffice packages on Red Hat Enterprise Linux:\n```\ndnf remove libreoffice\\*\n```\nCaveats:\nRemoving LibreOffice removes office productivity features and may remove optional graphical desktop metapackages. System and terminal administration remain unaffected. If LibreOffice is required for everyday operations, restrict data source directories to trusted files or execute the application within an isolated environment."}, "name": "CVE-2026-76181", "public_date": "2026-11-05T19:57:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76181\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76181\nhttps://www.libreoffice.org/about-us/security/advisories/cve-2026-76181"], "statement": "This vulnerability is rated as Moderate rather than Important because successful exploitation requires local user interaction to process an untrusted database source and is constrained to the privileges of the running desktop user. In Red Hat Enterprise Linux environments, LibreOffice is an optional desktop productivity application not executed as a privileged system service or exposed to remote network traffic by default. An attacker must convince a user to configure or open a directory containing a maliciously structured dBASE index file, limiting the blast radius primarily to application denial of service or client-side memory corruption.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[26.2,26.2.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[26.8,26.8.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "LibreOffice", "source": "cna", "vendor": "The Document Foundation"}, "product": "libreoffice", "vendor": "the_document_foundation"}], "created": "2026-11-05T21:45:05.122382+00:00", "updated": "2026-11-05T22:45:09.651275+00:00", "vendors": ["the_document_foundation", "the_document_foundation$PRODUCT$libreoffice"]}