Description (CNA)
LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| The Document Foundation / LibreOffice | affected 25.8 before < 25.8.7; affected 26.2 before < 26.2.3 |
CWE
CWE-787, CWE-843
References
ADP enrichment
No English description supplied.
No references supplied.