CVE-2026-8357 Heap buffer overflow in Calc formula compilation
A heap buffer overflow in LibreOffice Calc allows attackers to execute arbitrary code or cause a crash by providing a specially crafted spreadsheet with a long formula.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-8357?
CVE-2026-8357 is a medium-severity memory corruption vulnerability in The Document Foundation LibreOffice, published on 15 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.
Which versions are affected by CVE-2026-8357?
Linux distribution packages (40)
autocorr-af AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-bg AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-ca AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-cs AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-da AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-de AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-en AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-es AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-fa AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-fi AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-fr AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-ga AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-hr AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-hu AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-is AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-it AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-ja AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-ko AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-lb AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-lt AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-mn AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-nl AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-pl AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-pt AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-ro AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-ru AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-sk AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-sl AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-sr AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-sv AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-tr AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-vi AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
autocorr-zh AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
libreoffice AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
libreoffice-base AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
libreoffice-calc AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
libreoffice-core AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
libreoffice-data AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
libreoffice-draw AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
libreoffice-emailmerge AlmaLinux:8 | All versions | 1:6.4.7.2-21.el8_10.alma.1 |
How do I fix CVE-2026-8357?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-8357 being exploited?
There is no known exploitation of CVE-2026-8357 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:35839, ALSA-2026:36832, DEBIAN-CVE-2026-8357, GHSA-j779-pcc6-8c5f, RHSA-2026:35839, RHSA-2026:36832 and 9 more.