LibreOffice contains an out‑of‑bounds write vulnerability that can be triggered by opening specially crafted OOXML documents with mismatched encryption salts. This flaw allows writing data beyond the intended memory buffer, potentially corrupting heap structures. While the description does not confirm arbitrary code execution, such heap corruption could lead to application crashes, data loss, or, in the worst case, exploitation of control flow to execute arbitrary code.

The vulnerability affects LibreOffice versions 25.8.0 through 25.8.6 and 26.2.0 through 26.2.2, released by The Document Foundation.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited publicly observed exploitation. The likely attack vector involves an attacker convincing a user to open the malicious OOXML file, which is a local‑user or file‑system attack scenario. The potential for memory corruption represents a moderate risk to confidentiality, integrity, and availability of the affected system.