ANT-2026-6X60WXT0 · libreoffice

use-after-free medium

CVE-2026-6040

Severity Claude medium · Security research firm medium · Maintainer medium

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-6X60WXT0: Heap use-after-free write in number format blank-width parsing via out-of-bounds remove() on freed buffer

A heap use-after-free write occurs in the number-format blank-width parsing path when an out-of-bounds remove() is performed on a buffer that has already been freed.

Target

Project: libreoffice
Discovery: static analysis — not yet dynamically reproduced

Technical Details

During blank-width handling in the number formatter, remove() is invoked with an out-of-bounds index against a heap buffer that was previously freed, producing a write to freed heap memory (heap-use-after-free).

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-6X60WXT0.

Reference: ANT-2026-6X60WXT0
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict: true positive
Severity: medium

TIMELINE

Dates from discovery through public reveal.

2026-03-29 Reported to tracker
2026-04-09 Sent to maintainer
2026-05-09 Maintainer acknowledged
2026-06-14 Patch released
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

3c7dd416faebb445da843e126649c13ef1d746c3f3fedf523eea12f5b37281912d5c9e93303c7023ddd6cf3cc713b82fffbb148a2cc03932aec7e12f4b2bc465

Committed 2026-04-09 11:50 PT

Revealed 2026-08-17 14:12 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-6X60WXT0",
  "bug_class": "Use-After-Free",
  "claude_severity": "medium",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:12+00:00",
  "description": "A heap use-after-free write occurs in the number-format blank-width parsing path when an out-of-bounds remove() is performed on a buffer that has already been freed.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "LibreOffice",
  "reproduction": null,
  "technical_details": "During blank-width handling in the number formatter, remove() is invoked with an out-of-bounds index against a heap buffer that was previously freed, producing a write to freed heap memory (heap-use-after-free).",
  "title": "Heap use-after-free write in number format blank-width parsing via out-of-bounds remove() on freed buffer",
  "vendor_severity": "medium"
}