CVE-2026-8357

HighCVSS 7.8/10Last modified Jul 28, 2026

Description

LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-193CWE-787CWE-131

Affected software

VendorProductVersions
The Document FoundationLibreOffice>= 26.2, < < 26.2.4
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 6—

References

Timeline

Published
Jun 15, 2026
Last modified
Jul 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-835707.8Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-835715.5Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally.CVE-2026-835736.8Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-835747.0Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-835757.0Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-835789.8Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.CVE-2026-835797.8Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.CVE-2026-83585.4LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same chanCVE-2026-835807.0Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.CVE-2026-835824.7Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally.CVE-2026-835837.8Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.CVE-2026-835847.0Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.
CVE-2026-8357: High severity, CVSS 7.8 | Vulnix