CVE-2026-6045— Heap buffer overflow in EMF+ gradient brush import

Heap buffer overflow in EMF+ gradient brush import

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and then filled as if it were large, writing past its end. In fixed versions the blend-point count is checked against the data actually available before allocating.

N/A

跨界内存写

The Document Foundation LibreOffice 数字错误漏洞

The Document Foundation LibreOffice是The Document Foundation的办公套件。 The Document Foundation LibreOffice存在安全漏洞，该漏洞源于导入EMF+渐变画笔时存在堆缓冲区溢出，渐变混合点数从文件中读取并用于计算分配大小，但乘法可能溢出，导致分配小缓冲区后超限写入。

N/A

N/A