PatchSiren cyber security CVE debrief

CVE-2026-6040 The Document Foundation CVE debrief

A heap use-after-free vulnerability existed in LibreOffice when importing the blank-width characters of an ODF number format. The issue occurred because a position value read from the document was not checked against the length of the format-code string. This allowed a malformed number format to be processed against memory outside that string. In fixed versions, the position is bounds-checked before use.

Vendor: The Document Foundation
Product: LibreOffice
CVSS: MEDIUM 5.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-15
Original CVE updated: 2026-06-15
Advisory published: 2026-06-15
Advisory updated: 2026-06-15

Who should care

Users of LibreOffice, especially those who open documents from untrusted sources, should be aware of this vulnerability.

Technical summary

The vulnerability has a CVSS score of 5.4 and is classified as CWE-416 (Use After Free) and CWE-787 (Out-of-bounds Write).

Defensive priority

MEDIUM

Recommended defensive actions

Update to the latest version of LibreOffice to ensure the bounds-checking fix is applied.

Evidence notes

The CVE was published on June 15, 2026, and has a single reference to the LibreOffice security advisory.

Official resources

CVE-2026-6040 was published on 2026-06-15T18:16:36.880Z.