LibreOffice Calc’s import of spreadsheet tracked changes can trigger a heap buffer overflow when a document reuses a change identifier for two different change types. The importer misinterprets one change object as a larger type and writes beyond its allocation, corrupting memory. According to the CWE identifiers, this is a classic out‑of‑bounds write (CWE‑787) coupled with an improper type conversion (CWE‑843). The resulting memory corruption could potentially allow an attacker to hijack execution flow or crash the application, creating a local vulnerability for privilege escalation or denial of service.

LibreOffice, specifically its Calc component, on all releases that allow tracked‑changes import before the enforcement of duplicate‑identifier rejection. Exact version numbers are not supplied, but any version that processes tracked changes without validation is susceptible.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious spreadsheet file containing duplicate change identifiers and local interaction by a user who imports the file into Calc. Consequently, the risk is moderate but unlikely to be actively exploited in the wild.