LibreOffice dBase parser heap overflow allows code execution
ZDI rates CVE-2026-76181 at CVSS 7.8 and says the target must open a malicious file or page.
58
Vulnerability4 · 4 reads
CVE-2026-76181
Heap overflow in LibreOffice dBASE .ndx index parsing
- CVSS 4.0
- 5.4 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
LibreOffice’s dBASE driver overflows a heap buffer when it reads an .ndx index page whose recorded entry count exceeds what the page can hold. A crafted index can also point a page back at itself, so parsing recurses without end. A user must open a folder of dBASE files as a data source; no privileges are required. Impact is local memory corruption, including a crash, on LibreOffice.
What to do: Apply The Document Foundation’s update for CVE-2026-76181. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| The Document Foundation LibreOffice | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.
- Weakness
- CWE-674, CWE-787
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X