CVE-2026-6047: Heap buffer overflow in OOXML text box element import
LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Avoid importing or opening OOXML (DOCX) documents from untrusted sources. If such files must be inspected, do so in an isolated/sandboxed environment (for example a VM, container, or restricted account) or convert them to a safer format before opening.
- Operational
Monitor LibreOffice vendor advisories for the release of fixed versions that implement the described type check for OOXML import, and apply those updates as soon as they are available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6047?
The severity of CVE-2026-6047 is medium with a CVSS score of 5.4.
How do I fix CVE-2026-6047?
To fix CVE-2026-6047, update to the latest version of LibreOffice that addresses this vulnerability.
What causes CVE-2026-6047?
CVE-2026-6047 is caused by a heap buffer overflow due to improper handling of OOXML text box element imports.
Which software is affected by CVE-2026-6047?
CVE-2026-6047 affects the LibreOffice software developed by The Document Foundation.
What is the potential impact of CVE-2026-6047?
The potential impact of CVE-2026-6047 includes possible exploitation that could lead to arbitrary code execution.