CVE-2026-6039 Details
Description
LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a polyline whose point count exceeded the 16-bit range was written past the end of the buffer. In fixed versions such oversized polylines are rejected.
A heap buffer overflow vulnerability has been identified in LibreOffice when importing DXF files created by CAD software. The issue arises in the handling of polylines, where the point count is incorrectly truncated to a 16-bit value for buffer allocation. This flaw allows polylines with point counts exceeding the 16-bit limit to overflow the buffer. In versions of LibreOffice that have addressed this vulnerability, oversized polylines are now rejected.
Users can upgrade to LibreOffice versions 26.2.3, 25.8.7, or 24.2.4 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 15, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.libreoffice.org/about-us/security/advisories/cve-2026-6039 | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-197 | Numeric Truncation Error | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LibreOffice | >= 26.0, < 26.2.3 >= 25.0, < 25.8.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | New CVE Received | [email protected] |