CVE-2026-4430

Think of LibreOffice like software for reading office documents. This bug can be activated only when someone opens a “maliciously made” document, and it may cause the computer running LibreOffice to be compromised in serious ways—similar to a booby-trapped document that tricks the program into writing past its safe memory limits.

This matters if you run LibreOffice on any machines where users open office documents, especially documents from email or the internet. It requires user interaction (someone opening the crafted document) and does not require the attacker to have a login. Based on the findings, it’s a risk specifically when the vulnerable LibreOffice version processes an attacker-prepared OOXML document (reachable depends on whether that feature/use is used, but the direct trigger is opening the malicious document).

This is an AMBER issue because it can lead to serious outcomes (including potential code execution) and relies on a common user action: opening documents. There is no confirmed public exploit code recorded and it is not listed in KEV, so the immediate “everyone is being hit today” signal is lower—but you should still upgrade promptly to remove the risk.

Confirm exposure

• On each affected workstation and server where users open office documents, check the installed LibreOffice version.
• Treat machines as exposed if they match either of these ranges:
  • LibreOffice 25.8 (from 25.8 before 25.8.7.0)
  • LibreOffice 26.2 (from 26.2 before 26.2.3)

Upgrade to the fixed version

• Upgrade LibreOffice to 25.8.7.0 (or a later fixed build available via your normal update path).
• If you manage updates centrally, apply the update as a standard software rollout to reduce the chance users remain on vulnerable versions.

Temporary workarounds (if you can’t patch right away)

• Reduce the likelihood that users open untrusted documents:
  • Restrict opening files directly from email attachments and unknown sources where practical.
  • Encourage safe handling: verify sender/links and avoid opening unexpected documents.
• Consider temporarily disabling or restricting access to document sources that are most likely to deliver untrusted OOXML files (based on your business’s threat exposure).

What to monitor

• After upgrades, verify LibreOffice versions changed to the fixed release.
• Keep an eye out for unusual endpoint behavior following document opens (for example, unexpected processes or persistence mechanisms), and respond according to your existing incident process.

Due date

• No KEV due date was provided in the findings (not listed in CISA KEV).

Severity and type

• CVE-2026-4430 is a heap buffer overflow (CWE-787) in LibreOffice when processing crafted OOXML documents.

Mechanism / trigger

• The crash/exploit trigger involves maliciously crafted OOXML with mismatched encryption salt parameters. When LibreOffice processes such a document on open, it can perform an out-of-bounds write to heap memory.

Attack vector and prerequisites

• Attack vector is local in the reporting, with no authentication required.
• User interaction is required: an end user must open the crafted document.
• Preconditions provided: user opens a malicious OOXML document with mismatched encryption salt parameters.

Affected and fixed versions

• Findings state affected ranges:
  • LibreOffice: from 26.2 before 26.2.3
  • LibreOffice: from 25.8 before 25.8.7.0
• Fixed in: 25.8.7.0.

Exploitation status / maturity

• Not listed in CISA KEV.
• No public exploit code is on record.
• Press attention is rising (buzz indicator), but exploitation confirmation is not present in the provided findings.

Likelihood signal

• EPSS was provided as a prediction, but public blocks should not rely on it when real exploitation signals exist (here, none were provided in findings). EPSS therefore should not drive the urgency beyond standard patching.