CVE-2026-8357: Heap buffer overflow in Calc formula compilation
Last updated 4 July 2026
Other sources
LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libreofficeto a version that resolves this vulnerability.Fixed in 4:7.4.7-1+deb12u14Fixed in 4:7.4.7-1+deb12u13Fixed in 4:25.2.3-2+deb13u6Fixed in 4:25.2.3-2+deb13u5Fixed in 4:26.2.4.2-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8357?
The severity of CVE-2026-8357 is rated as medium with a CVSS score of 5.4.
How do I fix CVE-2026-8357?
To fix CVE-2026-8357, users should update LibreOffice to the latest version that addresses the heap buffer overflow vulnerability.
What type of vulnerability is CVE-2026-8357?
CVE-2026-8357 is a buffer overflow vulnerability occurring during the compilation of cell formulas in LibreOffice Calc.
What are the potential impacts of CVE-2026-8357?
The potential impacts of CVE-2026-8357 include the possibility of arbitrary code execution or crash of the LibreOffice application.
When was CVE-2026-8357 published?
CVE-2026-8357 was published on June 15, 2026.