CVE-2026-8357 Details
Description
LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.
A heap buffer overflow vulnerability has been identified in LibreOffice Calc. This issue arises when the application compiles cell formulas in spreadsheets. The vulnerability occurs with very long formulas that contain many opening tokens. The problem lies in the array that tracks the nesting depth, which was allocated one element too small for such extreme cases. As a result, a long formula could overwrite memory by writing past the end of the array. In the fixed versions, the array is properly sized to accommodate the maximum possible nesting depth.
Users can upgrade to LibreOffice versions 26.2.3, 25.8.7, or 24.8.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 15, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:35839 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:36832 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:43423 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:43424 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:43425 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:43460 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:43461 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:46386 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:46387 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-8357 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2488964 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8357.json | redhat-SADP | |
| https://www.libreoffice.org/about-us/security/advisories/cve-2026-8357 | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-131 | Incorrect Calculation of Buffer Size | redhat-SADP |
| CWE-193 | Off-by-one Error | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LibreOffice | < 26.2.3 (semver) < 25.8.7 (semver) |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | redhat-SADP |
| Jul 23, 2026 | CVE Modified | redhat-SADP |
| Jul 22, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 9, 2026 | CVE Modified | redhat-SADP |
| Jul 6, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | New CVE Received | [email protected] |