CVE-2026-4430

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Write in LibreOffice via OOXML Encryption Mismatch

Publication date: 2026-05-07

Last updated on: 2026-05-08

Assigner: Document Foundation, The

Description

Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-07

Last Modified

2026-05-08

Generated

2026-07-06

AI Q&A

2026-05-07

EPSS Evaluated

2026-07-05

NVD

CVE-2026-4430

EUVD

EUVD-2026-28327

Affected Vendors & Products

Vendor	Product	Version / Range
libreoffice	libreoffice	From 25.8.0.0 (inc) to 25.8.7.0 (exc)
libreoffice	libreoffice	From 26.2.0.0 (inc) to 26.2.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-4430 is a heap buffer overflow vulnerability in LibreOffice that occurs when processing specially crafted OOXML documents containing mismatched encryption salt parameters. This causes an out-of-bounds write in the software.

The vulnerability affects LibreOffice versions 26.2 before 26.2.3 and 25.8 before 25.8.7.

Impact Analysis

This vulnerability can lead to memory corruption due to an out-of-bounds write, which may be exploited to cause a crash or potentially execute arbitrary code when opening a crafted OOXML document in affected LibreOffice versions.

Users running vulnerable versions of LibreOffice are at risk if they open maliciously crafted documents.

Mitigation Strategies

To mitigate this vulnerability, users should upgrade LibreOffice to version 26.2.3 or 25.8.7 or later.

This update fixes the out-of-bounds write vulnerability caused by processing crafted OOXML documents with mismatched encryption salt parameters.

Hi! I’m here to help you understand CVE-2026-4430. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70