CVE-2026-76181

MediumCVSS 6.6/10Last modified Nov 12, 2026

Description

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-674 CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
The Document Foundation	LibreOffice	>= 26.2, < < 26.2.6; >= 26.8, < < 26.8.1

References

https://www.libreoffice.org/about-us/security/advisories/cve-2026-76181

Timeline

Published: Nov 5, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-761826.9In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, whe CVE-2026-761839.8Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be byp CVE-2026-761848.2In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the r CVE-2026-761856.5Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, se CVE-2026-761869.1Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token b CVE-2026-761879.8Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client register CVE-2026-761896.2CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of CVE-2026-76196.5The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic S CVE-2026-761908.6ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could CVE-2026-761918.2Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execut CVE-2026-761925.5InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker CVE-2026-7619310.0Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution