Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-11-05T19:57:48 libreoffice: libreoffice: Denial of Service via crafted dBASE index file 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H CWE-787

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.

A flaw was found in LibreOffice. The application's dBASE database driver fails to validate entry counts against page capacity and does not prevent circular page references when parsing index (.ndx) files. By convincing a user to open a data source with a specially crafted dBASE index file, an attacker can trigger infinite recursion or a heap-based buffer overflow. This primarily leads to an application crash resulting in a Denial of Service (DoS) and may potentially cause memory corruption.

This vulnerability is evaluated as having a Moderate severity because exploitation requires local user interaction to open a maliciously crafted database source, which limits the blast radius to an application crash or potential memory corruption within the active user session. Supported Red Hat Enterprise Linux releases are not affected by this flaw as the vulnerable database index processing code is not present in their shipping packages. Avoid opening or connecting to untrusted dBASE tables and associated index files (.ndx). On systems where LibreOffice productivity software is not required, remove the packages to eliminate the attack surface. To remove LibreOffice packages on Red Hat Enterprise Linux: ``` dnf remove libreoffice\* ``` Caveats: Removing LibreOffice removes office productivity features and may remove optional graphical desktop metapackages. System and terminal administration remain unaffected. If LibreOffice is required for everyday operations, restrict data source directories to trusted files or execute the application within an isolated environment. Red Hat Enterprise Linux 6 Not affected libreoffice Red Hat Enterprise Linux 7 Not affected libreoffice Red Hat Enterprise Linux 8 Not affected libreoffice Red Hat Enterprise Linux 9 Not affected libreoffice https://www.cve.org/CVERecord?id=CVE-2026-76181 https://nvd.nist.gov/vuln/detail/CVE-2026-76181 https://www.libreoffice.org/about-us/security/advisories/cve-2026-76181