CVE-2026-6045

Description

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and then filled as if it were large, writing past its end. In fixed versions the blend-point count is checked against the data actually available before allocating.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libreoffice	26.04 LTS resolute	Fixed 4:26.2.4.2-0ubuntu0.26.04.2
	25.10 questing	Ignored end of life, was needs-triage
	24.04 LTS noble	Fixed 4:24.2.7-0ubuntu0.24.04.6
	22.04 LTS jammy	Fixed 1:7.3.7-0ubuntu0.22.04.12
	20.04 LTS focal	Needs evaluation

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libreoffice	Upstream: https://git.libreoffice.org/core/+/10d8ec59242b8a71fbbdff3c1f181dedefcf2b78 Upstream: https://git.libreoffice.org/core/+/b89744882ba708d605e1ff0b595d4401c5bda0ee Upstream: https://git.libreoffice.org/core/+/2672692c7213dfd2d41a4e7f8e1b98be3f7d281d

Severity score breakdown

CVSS version: CVSS v4.0

Base score 5.4 · Medium

Base metrics

Parameter	Value
Attack vector	Local
Attack complexity	Low
Attack requirements	None
Privileges required	None
User interaction	Passive
Vulnerable system - Confidentiality impact	Low
Vulnerable system - Integrity impact	Low
Vulnerable system - Availability impact	High
Subsequent system - Confidentiality impact	None
Subsequent system - Integrity impact	None
Subsequent system - Availability impact	None

Scores

Parameter	Value
Base score	5.4 · Medium
Base + Threat score	-
Base + Environmental score	-
Base + Threat + Environmental score	-

Description

Status

Patch details

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities