PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-97222 GNOME CVE debrief

A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash. This issue affects Gnumeric installations and defenders should assess exposure and prioritize patching or applying workarounds to prevent potential crashes of the Gnumeric application. The CVE record and NVD entry provide details on the heap use-after-free flaw, but do not specify affected or fixed versions, requiring verification of Gnumeric installations for exposure.

Vendor
GNOME
Product
Gnumeric
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-25
Original CVE updated
2026-09-25
Advisory published
2026-09-25
Advisory updated
2026-09-25

Who should care

Defenders responsible for Gnumeric installations should assess exposure and prioritize patching or applying workarounds to prevent potential crashes of the Gnumeric application. This includes verifying Gnumeric installations for exposure, applying patches or workarounds, and monitoring Gnumeric logs for suspicious activity. Security teams and vulnerability management teams should also review the CVE record and NVD G

Why it matters

Defenders should prioritize verifying Gnumeric installations for exposure and applying patches or workarounds to prevent potential crashes.

  • Potential crashes of Gnumeric application
  • Verification of Gnumeric installations for exposure

Technical summary

A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash. This issue affects Gnumeric installations and defenders should assess exposure and prioritize patching or applying workarounds. The vulnerability is triggered by a specific malformed element in a Gnumeric workbook.

Defensive priority

Defenders should prioritize verifying Gnumeric installations for exposure and applying patches or workarounds to prevent potential crashes.

Recommended defensive actions

  • Verify Gnumeric installations for exposure
  • Apply patches or workarounds to prevent potential crashes
  • Monitor Gnumeric logs for suspicious activity

Evidence notes

The CVE record and NVD entry provide details on the heap use-after-free flaw in Gnumeric, but do not specify affected or fixed versions. Defenders should verify Gnumeric installations for exposure and apply patches or workarounds to prevent potential crashes. The flaw is caused by a malformed SheetObjectComponent element in a crafted Gnumeric workbook, which can cause the XML parser to dereference a freed sheet-object component.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-97222 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-97222

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-97222 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-97222

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.