CVE-2026-8357CWE-193CWE-787

Heap buffer overflow in Calc formula compilation

Medium · published June 15, 2026

CVSS v4.0
5.4
EPSS
0%
Percentile
12.7
In the wild
Unconfirmed
What it is

LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.

The record
Technical detail
CVSS v4.0
5.4 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00227 · 12.7th percentile
Weaknesses
CWE-193 · Off-by-one Error; CWE-787 · Out-of-bounds Write
Published
2026-06-15T16:23Z
EPSS history
Timeline
  • 15 JUN 16:23Z
    Heap buffer overflow in Calc formula compilation
    cvelistv5