LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying
    deferred parser events for a text box element. A handler object was assumed to be of one type and written
    to at that type's field layout, but it could be a smaller object, so the write landed past the end of the
    allocation. In fixed versions the type is checked before the write. (CVE-2026-6047)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3140-1 advisory.

    Update to LibreOffice 26.2.5.1.

    Security issues fixed:

    - CVE-2026-4430: out-of-bounds write via crafted OOXML documents with mismatched encryption salt     parameters       (bsc#1264357).
    - CVE-2026-6039: denial of service via specially crafted DXF polyline import (bsc#1268494).
    - CVE-2026-6040: heap use-after-free when importing the blank-width characters of an ODF number format     (bsc#1268527).
    - CVE-2026-6045: heap buffer overflow via crafted EMF+ graphics import (bsc#1268497).
    - CVE-2026-6047: denial of service via heap buffer overflow in OOXML document processing (bsc#1268504).
    - CVE-2026-8356: denial of service via a specially crafted PPT file (bsc#1268522).
    - CVE-2026-8357: heap buffer overflow in Calc formula compilation (bsc#1268528).
    - CVE-2026-8358: heap buffer overflow in spreadsheet tracked-changes import (bsc#1268529).
    - CVE-2026-50593: graphite2: out-of-bounds write via Graphite actions (bsc#1267735).

    Other updates and bugfixes:

    - Update to LibreOffice 26.2.5.1.
      - Update bundled dependencies:
        * `fontconfig` 2.17.1 -> 2.18.0
        * `graphite2-minimal` 1.3.14 -> 1.3.15
        * `libcmis` 0.6.2 -> 0.6.3
        * `libgpg-error` 1.59 -> 1.61
        * `lxml` 6.1.0 -> 6.1.1
        * `md4c` 0.5.2 -> 0.5.3
        * `poppler` 26.04.0 -> 26.06.0
        * `sqlite-amalgamation` 3530000 -> 3530100
        * `xmlsec1` 1.3.9 -> 1.3.11
    - Update to LibreOffice 26.2.3.2 (PED-16098).
      - Upgraded dependencies:
        * `boost`: 1_88_0 -> 1_89_0
        * `freetype`: 2.14.1 -> 2.14.3
        * `harfbuzz`: 12.3.0 -> 12.3.2
        * `icu4c`: 77_1 -> 78.3
        * `libgpg-error`: 1.56 -> 1.59
        * `liborcus`: 0.20.1 -> 0.21.0
        * `pdfium`: 7012 -> 7471
        * `poppler`: 25.12.0 -> 26.04.0
        * `skia`: m136 -> m142
      - New bundled sources:
        * `afdko` 4.0.3
        * `antlr4-cpp-runtime` 4.13.2
        * `fast_float` 8.2.2
        * `libffi` 3.5.2
        * `lxml` 6.1.0
        * `md4c` 0.5.2
        * `meson` 1.8.3
        * `Python` 3.12.13
        * `sqlite` 3530000
        * `xmlsec1` 1.3.9
        * `xz` 5.8.3
    - Add `patch`, required to build the bundled Python on all architectures.
    - Bundling a specific Python is now required as the one we ship (3.6) is too old to build `harfbuzz`.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying     deferred parser events for a text box element. A handler object was assumed to be of one type and written     to at that type's field layout, but it could be a smaller object, so the write landed past the end of the     allocation. In fixed versions the type is checked before the write. (CVE-2026-6047)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
460444	Echo: libreoffice: security update to 4:25.2.3-2+deb13u6	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460444	Echo: libreoffice: security update to 4:25.2.3-2+deb13u6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
328909	SUSE SLED15: libreoffice / libreoffice-base / libreoffice-base-drivers-firebird / etc (SUSE-SU-2026:3140-1)	Nessus	SuSE Local Security Checks	Local	medium
321146	Linux Distros Unpatched Vulnerability : CVE-2026-6047	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-6047

medium

Tenable Plugins

medium

medium

medium

medium