CVE-2026-4430
Analyzed Analyzed - Analysis Complete
Out-of-Bounds Write in LibreOffice via OOXML Encryption Mismatch

Publication date: 2026-05-07

Last updated on: 2026-05-08

Assigner: Document Foundation, The

Description
Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-07
Last Modified
2026-05-08
Generated
2026-06-16
AI Q&A
2026-05-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-4430
EUVD
EUVD-2026-28327
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
libreoffice libreoffice From 25.8.0.0 (inc) to 25.8.7.0 (exc)
libreoffice libreoffice From 26.2.0.0 (inc) to 26.2.3.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-4430 is a heap buffer overflow vulnerability in LibreOffice that occurs when processing specially crafted OOXML documents containing mismatched encryption salt parameters. This causes an out-of-bounds write in the software.

The vulnerability affects LibreOffice versions 26.2 before 26.2.3 and 25.8 before 25.8.7.

Impact Analysis

This vulnerability can lead to memory corruption due to an out-of-bounds write, which may be exploited to cause a crash or potentially execute arbitrary code when opening a crafted OOXML document in affected LibreOffice versions.

Users running vulnerable versions of LibreOffice are at risk if they open maliciously crafted documents.

Mitigation Strategies

To mitigate this vulnerability, users should upgrade LibreOffice to version 26.2.3 or 25.8.7 or later.

This update fixes the out-of-bounds write vulnerability caused by processing crafted OOXML documents with mismatched encryption salt parameters.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4430. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart