Heap Buffer Overflow in LibreOffice dBASE Driver
CVE-2026-76181

5.4MEDIUM

Key Information:

Vendor

The Document Foundation

Status
Libreoffice
Vendor
CVE Published:
5 November 2026

What is CVE-2026-76181?

A heap buffer overflow vulnerability in the dBASE database driver of LibreOffice poses significant risks during the reading of dBASE tables and their .ndx index files. This occurs when the number of entries recorded in an index page is not validated against the maximum capacity specified in the index header. Additionally, a crafted index can create a self-referential loop resulting in an endless recursive reading process. The fixed versions implement strict limits on the index header and page entry counts to prevent such overflow and recursion vulnerabilities.

Affected Version(s)

LibreOffice 26.2

LibreOffice 26.8

References

https://www.libreoffice.org/about-us/security/advisories/...

CVSS V4

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude, found by Anthropic using agents to study the security of open-source projects
Ada Logics, validating and reporting
Anonymous working with TrendAI Zero Day Initiative
Caolán McNamara of Collabora Productivity
.