CVE-2018-10120: Buffer Overflow
Last updated 25 August 2025
Other sources
LibreOffice before versions 5.4.6.1 and 6.0.2.1 has a missing bounds check in sw/source/filter/ww8/ww8toolbar.cxx:SwCTBWrapper::Read() allowing for an out of bounds write. An attacker could exploit this to cause a denial of service via crafted document.
External Reference:
https://www.libreoffice.org/about-us/security/advisories/cve-2018-10120/
Additional Reference:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6173
Upstream Patches:
https://gerrit.libreoffice.org/gitweb?p=core.git;a=commit;h=017fcc2fcd00af17a97bd5463d89662404f57667 https://gerrit.libreoffice.org/#/c/49486/ https://gerrit.libreoffice.org/#/c/49499/ https://gerrit.libreoffice.org/#/c/49500/
— Red Hat
The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libreofficeto a version that resolves this vulnerability.Fixed in 5.4.6.1 - Upgrade
Upgrade
redhat/libreofficeto a version that resolves this vulnerability.Fixed in 6.0.2.1 - Upgrade
Upgrade
debian/libreofficeto a version that resolves this vulnerability.Fixed in 1:7.0.4-4+deb11u10Fixed in 1:7.0.4-4+deb11u13Fixed in 4:7.4.7-1+deb12u10Fixed in 4:7.4.7-1+deb12u8Fixed in 4:25.2.3-2+deb13u3Fixed in 4:26.2.0-1Fixed in 4:26.2.1-1 - Upgrade
Upgrade
LibreOfficeto a version that resolves this vulnerability.Fixed in 5.4.6.1 - Upgrade
Upgrade
LibreOfficeto a version that resolves this vulnerability.Fixed in 6.0.2.1
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2018-10120.
What is the severity rating of CVE-2018-10120?
CVE-2018-10120 has a severity rating of 7.8 (High).
Which software versions are affected by CVE-2018-10120?
CVE-2018-10120 affects LibreOffice versions before 5.4.6.1 and 6.x before 6.0.2.1.
How can CVE-2018-10120 be exploited?
CVE-2018-10120 can be exploited by remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified impacts.
Are there any remedies available?
Remedies are available for CVE-2018-10120, with specific version updates provided by Red Hat, Ubuntu, Debian, and LibreOffice.