AI analysis
LibreOffice has a heap buffer overflow when it imports Windows Metafile (WMF) graphics that can be embedded in documents. A text record can carry its own character advance widths; the count of those widths and the text length are read separately and were not required to match, so drawing the text walks the advance array by character and reads or writes past the end when the array is shorter. A crafted document opened locally can crash LibreOffice (high availability impact) and may cause limited confidentiality or integrity effects inside the process; CVSS 4.0 is 5.4 with local access and user interaction required, and no scope change. Anyone who opens untrusted documents in affected LibreOffice builds is exposed. It is not in CISA KEV, and no public proof-of-concept is known (CVSS exploit maturity E:P does not by itself confirm a public exploit).
What to do: Install a LibreOffice build in which a short WMF advance array is ignored, using packages from The Document Foundation or your distribution (Ubuntu: USN-8868-1). Until then, do not open documents from untrusted sources that may embed WMF graphics. The supplied data does not name fixed version numbers, so use the vendor or distro advisory for the exact package.
Affected
| The Document Foundation LibreOffice | Versions that import WMF text records with a separate advance-width count; fixed versions ignore an advance array shorter than the text (exact version numbers n |
Estimated exposure
massTens of millions of desktop installations (order-of-magnitude estimate) — LibreOffice is a widely shipped free desktop office suite with a user base well above one million across direct installs and Linux distributions; no internet-exposed service count applies because the flaw needs a local user to open a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.