CVE-2026-8356

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8356", "assignerOrgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "state": "PUBLISHED", "assignerShortName": "Document Fdn.", "dateReserved": "2026-05-11T18:42:20.783Z", "datePublished": "2026-06-15T16:23:06.477Z", "dateUpdated": "2026-06-15T18:05:22.786Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "shortName": "Document Fdn.", "dateUpdated": "2026-06-15T16:23:06.477Z"}, "title": "Stack buffer overflow in PPT presentation import", "datePublic": "2026-06-15T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-44", "descriptions": [{"lang": "en", "value": "CAPEC-44 Overflow Binary Resource File"}]}], "affected": [{"vendor": "The Document Foundation", "product": "LibreOffice", "versions": [{"status": "affected", "version": "26.2", "lessThan": "< 26.2.4", "versionType": "26.2 series"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.</p>"}]}], "references": [{"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-8356"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P"}}], "credits": [{"lang": "en", "value": "Anthropic (automated discovery using Claude)", "type": "finder"}, {"lang": "en", "value": "Arthur Chan of Ada Logics (validation and reporting)", "type": "analyst"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-15T18:04:56.736672Z", "id": "CVE-2026-8356", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T18:05:22.786Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8356", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T18:04:56.736672Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T18:05:17.104Z"}}], "cna": {"title": "Stack buffer overflow in PPT presentation import", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Anthropic (automated discovery using Claude)"}, {"lang": "en", "type": "analyst", "value": "Arthur Chan of Ada Logics (validation and reporting)"}], "impacts": [{"capecId": "CAPEC-44", "descriptions": [{"lang": "en", "value": "CAPEC-44 Overflow Binary Resource File"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Document Foundation", "product": "LibreOffice", "versions": [{"status": "affected", "version": "26.2", "lessThan": "< 26.2.4", "versionType": "26.2 series"}], "defaultStatus": "unknown"}], "datePublic": "2026-06-15T00:00:00.000Z", "references": [{"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-8356"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.", "supportingMedia": [{"type": "text/html", "value": "<p>LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "shortName": "Document Fdn.", "dateUpdated": "2026-06-15T16:23:06.477Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8356", "state": "PUBLISHED", "dateUpdated": "2026-06-15T18:05:22.786Z", "dateReserved": "2026-05-11T18:42:20.783Z", "assignerOrgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "datePublished": "2026-06-15T16:23:06.477Z", "assignerShortName": "Document Fdn."}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "LibreOffice", "vendor": "The Document Foundation", "versions": [{"lessThan": "< 26.2.4", "status": "affected", "version": "26.2", "versionType": "26.2 series"}]}], "source": "security@documentfoundation.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables."}, {"lang": "es", "value": "LibreOffice puede importar presentaciones en el formato binario PPT heredado. Exist\u00eda un desbordamiento de b\u00fafer en la pila al importar un registro de reemplazo de color. Dos tablas de color de tama\u00f1o fijo se llenaban desde el archivo, pero la posici\u00f3n de escritura no se restablec\u00eda entre las dos pasadas sobre el registro, por lo que un archivo cuyas cuentas de color combinadas exced\u00edan el tama\u00f1o de la tabla escrib\u00eda m\u00e1s all\u00e1 del final de las tablas en la pila. En versiones corregidas, la segunda pasada no utilizada ya no se lee en esas tablas."}], "id": "CVE-2026-8356", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@documentfoundation.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8356", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-15T18:04:56.736672Z", "version": "2.0.3"}}]}, "published": "2026-06-15T18:16:37.390", "references": [{"source": "security@documentfoundation.org", "url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-8356"}], "sourceIdentifier": "security@documentfoundation.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}, {"lang": "en", "value": "CWE-787"}], "source": "security@documentfoundation.org", "type": "Secondary"}]}

{"bugzilla": {"description": "libreoffice: LibreOffice: Denial of Service via a specially crafted PPT file", "id": "2488961", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488961"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-131", "details": ["A flaw was found in LibreOffice. This vulnerability, a stack buffer overflow, occurs when processing specially crafted legacy PowerPoint (PPT) files. An attacker could exploit this by convincing a user to open a malicious document, which may lead to a denial of service (DoS) due to the application crashing. This primarily affects desktop users who handle untrusted files."], "mitigation": {"lang": "en:us", "value": "Users should exercise caution when opening untrusted or suspicious legacy PowerPoint (PPT) files. Avoid opening documents from unknown sources to prevent potential denial of service attacks. If possible, process untrusted documents in a sandboxed environment."}, "name": "CVE-2026-8356", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libreoffice", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "libreoffice", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libreoffice", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libreoffice", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-15T16:23:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-8356\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-8356\nhttps://www.libreoffice.org/about-us/security/advisories/cve-2026-8356"], "statement": "This Moderate impact denial of service vulnerability in LibreOffice is due to a stack buffer overflow when parsing specially crafted legacy PowerPoint (PPT) files. Successful exploitation requires user interaction, as an attacker must persuade a user to open a malicious document. The flaw primarily affects desktop users who process untrusted files.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[26.2,26.2.4)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 81.0, "source": "matching"}]}, "original": {"product": "LibreOffice", "source": "cna", "vendor": "The Document Foundation"}, "product": "libreoffice", "vendor": "the_document_foundation"}], "created": "2026-06-16T13:45:16.287128+00:00", "updated": "2026-06-17T23:15:14.311000+00:00", "vendors": ["the_document_foundation", "the_document_foundation$PRODUCT$libreoffice"]}