CVE-2026-76181
Description
A flaw was found in LibreOffice. The application's dBASE database driver fails to validate entry counts against page capacity and does not prevent circular page references when parsing index (.ndx) files. By convincing a user to open a data source with a specially crafted dBASE index file, an attacker can trigger infinite recursion or a heap-based buffer overflow. This primarily leads to an application crash resulting in a Denial of Service (DoS) and may potentially cause memory corruption.
Statement
This vulnerability is evaluated as having a Moderate severity because exploitation requires local user interaction to open a maliciously crafted database source, which limits the blast radius to an application crash or potential memory corruption within the active user session. Supported Red Hat Enterprise Linux releases are not affected by this flaw as the vulnerable database index processing code is not present in their shipping packages.
Mitigation
Avoid opening or connecting to untrusted dBASE tables and associated index files (.ndx). On systems where LibreOffice productivity software is not required, remove the packages to eliminate the attack surface.
To remove LibreOffice packages on Red Hat Enterprise Linux:
dnf remove libreoffice\*
Caveats:
Removing LibreOffice removes office productivity features and may remove optional graphical desktop metapackages. System and terminal administration remain unaffected. If LibreOffice is required for everyday operations, restrict data source directories to trusted files or execute the application within an isolated environment.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.6 | N/A | 6.6 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
