CVE-2026-6039: Heap buffer overflow in DXF polyline import
Last updated 4 July 2026
Other sources
LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a polyline whose point count exceeded the 16-bit range was written past the end of the buffer. In fixed versions such oversized polylines are rejected.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libreofficeto a version that resolves this vulnerability.Fixed in 4:7.4.7-1+deb12u14Fixed in 4:7.4.7-1+deb12u13Fixed in 4:25.2.3-2+deb13u6Fixed in 4:25.2.3-2+deb13u5Fixed in 4:26.2.4.2-2 - Compensating control
Use LibreOffice fixed versions where oversized DXF polylines are rejected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6039?
CVE-2026-6039 has a medium severity rating of 5.4 according to the CVSS score.
What type of vulnerability is CVE-2026-6039?
CVE-2026-6039 is a heap buffer overflow vulnerability found in LibreOffice.
How do I fix CVE-2026-6039?
To fix CVE-2026-6039, update LibreOffice to the latest version provided by The Document Foundation.
What impact does CVE-2026-6039 have on users?
CVE-2026-6039 can lead to potential memory corruption and could allow an attacker to execute arbitrary code.
Which software is affected by CVE-2026-6039?
CVE-2026-6039 affects LibreOffice, a software developed by The Document Foundation.