ANT-2026-TNXYTAEH · libreoffice
stack-buffer-overflow medium
Severity Claude critical · Security research firm high · Maintainer medium
Discovered by Claude Mythos Preview
Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.
ANT-2026-TNXYTAEH: Stack-buffer-overflow in libreoffice
The pptfuzzer harness was run against a single reproducer (/tmp/poc) and exited with a non-zero status (EXIT_CODE:1). No AddressSanitizer, UBSan, or other crash diagnostics were printed, so the crash type, faulting function, and access shape cannot be determined from this output alone. The target name suggests a PPT-format parsing entry point, but no source location or call chain is available.
Target
Project: libreoffice
Technical Details
libFuzzer target pptfuzzer terminated with EXIT_CODE:1 on the supplied input; no sanitizer diagnostic or stack trace was emitted.
Crash trace:
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1013862475
INFO: Loaded 1 modules (1616799 inline 8-bit counters): 1616799 [0x619344d44708, 0x619344ecf2a7),
INFO: Loaded 1 PC tables (1616799 PCs): 1616799 [0x619344ecf2a8,0x61934677ac98),
/out/pptfuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1
Reproduction
Reproduce against the target as described under Technical Details.
[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]
Acknowledgement
This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-TNXYTAEH.
Reference: ANT-2026-TNXYTAEH
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure
Triage and disclosure were performed by Ada Logics.
- Verdict
- true positive
- Severity
- high
Dates from discovery through public reveal.
- 2026-03-24 Reported to tracker
- 2026-04-25 Sent to maintainer
- 2026-05-12 Maintainer acknowledged
- 2026-05-13 Patch released
- 2026-07-13 Publicly revealed
SHA-3-512 hash:
d9cc357c5b6f7b6f74a76b06e2fe5f113c23a266bad42dd24dc5a86d1279175092594cbc68c21f6b8503bec67f6484af81dc7b3de16dcb8b2b7dc61abeeac758
Committed 2026-05-07 03:18 PT
Revealed 2026-07-13 17:08 PT
Verify (download preimage.json)
Show preimage JSON
{
"ant_id": "ANT-2026-TNXYTAEH",
"bug_class": "Stack-buffer-overflow",
"claude_severity": "critical",
"commit_sha": null,
"created_at": "2026-03-24T18:31:41+00:00",
"description": "The pptfuzzer harness was run against a single reproducer (/tmp/poc) and exited with a non-zero status (EXIT_CODE:1). No AddressSanitizer, UBSan, or other crash diagnostics were printed, so the crash type, faulting function, and access shape cannot be determined from this output alone. The target name suggests a PPT-format parsing entry point, but no source location or call chain is available.",
"discovered_at": null,
"location": null,
"poc_sha256": null,
"preimage_version": 1,
"project": "libreoffice",
"reproduction": null,
"technical_details": null,
"title": "Stack-buffer-overflow in libreoffice",
"vendor_severity": "high"
}