A heap use‑after‑free flaw exists in Gnumeric, the spreadsheet component of GNOME. When a workbook containing a malformed SheetObjectComponent element is opened, the XML parser dereferences a freed sheet‑object component, causing the application to crash. The weakness is identified as CWE‑416 and results in denial of service for users of the affected version.

The vulnerability affects GNOME Gnumeric. No specific version range is listed in the CNA data, so any release that has not been patched is potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity. Based on the description, the likely attack vector is local: the attacker would need to supply a malicious workbook that the user opens. The EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that the exploitation risk is probably low to medium. An attacker would achieve only a crash of the Gnumeric process; there is no evidence of code execution or other privilege escalation.