These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions, an entry in a Java class path has to be a file URL. This vulnerability affects LibreOffice users who open documents from [truncated]
A vulnerability in LibreOffice allows URLs in documents to expand environment variables and INI file values, potentially exfiltrating sensitive information. The issue was not fully addressed by the check for CVE-2024-12426. Fixed versions refuse URLs with internal schemes from documents. This vulnerability affects LibreOffice users who open documents from untrusted sources, as it could lead to sensitive i [truncated]
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under lin [truncated]
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. This vulnerability allows potential local file reads and requests to arbitrary hosts via external data links in LibreOffice Calc [truncated]
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory. The vulnerability allows for potential file creation in arb [truncated]
CVE-2026-8358 is a medium-severity vulnerability in LibreOffice Calc that can lead to a heap buffer overflow when importing tracked changes from a spreadsheet. The vulnerability occurs when a document reuses the same change identifier for two different kinds of change, causing the importer to treat one change object as a different, larger type and write past the end of its allocation. In fixed versions, r [truncated]
CVE-2026-8357 is a medium-severity vulnerability in LibreOffice Calc that can cause a heap buffer overflow when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for the worst-case scenario, allowing the formula to write one element past its end. In fixed versions, the array is sized to hold the largest possible nesting depth.
CVE-2026-8356 is a stack buffer overflow vulnerability in LibreOffice's PPT import feature. When importing a colour-replacement record from a PPT file, two fixed-size colour tables are filled from the file. However, the write position was not reset between the two passes over the record. This could allow a file with a combined colour count exceeding the table size to write past the end of the tables on th [truncated]
CVE-2026-6047 is a medium-severity vulnerability in LibreOffice, a popular open-source office suite. The vulnerability is caused by a heap buffer overflow that occurs when replaying deferred parser events for a text box element in the OOXML format (DOCX).
A heap buffer overflow existed in LibreOffice when importing EMF+ graphics. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and then filled as if it were large, writing past its end. This vulnerability requires verification and updating to fixed versions to prevent potential exploitat [truncated]
A heap use-after-free vulnerability existed in LibreOffice when importing the blank-width characters of an ODF number format. The issue occurred because a position value read from the document was not checked against the length of the format-code string. This allowed a malformed number format to be processed against memory outside that string. In fixed versions, the position is bounds-checked before use.
A heap buffer overflow existed in LibreOffice when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it. This could allow an attacker to write past the end of the buffer. In fixed versions, such oversized polylines are rejected.
