ANT-2026-XV1EVAMH · libreoffice

heap-buffer-overflow medium

CVE-2026-8357

Severity Claude critical · Security research firm high · Maintainer medium

Discovered by Claude Sonnet 4.6

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-XV1EVAMH: Heap-buffer-overflow in libreoffice

LibreOffice Calc's formula compiler (ScCompiler::CompileString in sc/source/core/tool/compiler.cxx) allocates a FunctionStack array sized to the formula string length when that length exceeds a 512-element stack buffer. For each '(' token it increments nFunction and writes to pFunctionStack[nFunction] without bounds checking. A crafted FODS file containing a formula of 513 '(' characters causes nFunction to reach 513 while the heap buffer has only indices 0-512, producing a 2-byte out-of-bounds heap write. An attacker who can get a victim to open a malicious FODS/ODS document can corrupt heap memory, potentially leading to code execution.

Target

Project: libreoffice

Technical Details

ASAN: heap-buffer-overflow WRITE of size 2 at 0x51d000009484 in ScCompiler::CompileString (compiler.cxx:4907:53). The root cause is an off-by-one: the FunctionStack heap buffer is sized to rFormula.getLength() (513), but nFunction starts at 0 and is pre-incremented once per '(' token, so 513 open-parens drive the index to 513 and pFunctionStack[513].eOp is written one element past the end of the allocation.

Crash trace:

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1873441852
INFO: Loaded 1 modules   (2649230 inline 8-bit counters): 2649230 [0x5f3f59fc7538, 0x5f3f5a24e1c6), 
INFO: Loaded 1 PC tables (2649230 PCs): 2649230 [0x5f3f5a24e1c8,0x5f3f5cabaaa8), 
/out/fodsfuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1

Reproduction

Reproduce against the target as described under Technical Details.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-XV1EVAMH.

Reference: ANT-2026-XV1EVAMH
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict
true positive
Severity
high
TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-24 Reported to tracker
  2. 2026-05-07 Sent to maintainer
  3. 2026-05-12 Maintainer acknowledged
  4. 2026-06-14 Patch released
  5. 2026-07-08 Publicly revealed
PROVENANCE

SHA-3-512 hash:

46a2e2e4443a4f989f784b937a63d3aa8021f566ad7d8f9974478c1791e72f7c64c4d7e525f2dab06d95313c4dd097f29f18a4934760cf9edc5ff0881631d565

Committed 2026-05-07 14:16 PT

Revealed 2026-07-08 16:30 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-XV1EVAMH",
  "bug_class": "Heap-buffer-overflow",
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-03-24T18:45:47+00:00",
  "description": "LibreOffice Calc's formula compiler (ScCompiler::CompileString in sc/source/core/tool/compiler.cxx) allocates a FunctionStack array sized to the formula string length when that length exceeds a 512-element stack buffer. For each '(' token it increments nFunction and writes to pFunctionStack[nFunction] without bounds checking. A crafted FODS file containing a formula of 513 '(' characters causes nFunction to reach 513 while the heap buffer has only indices 0-512, producing a 2-byte out-of-bounds heap write. An attacker who can get a victim to open a malicious FODS/ODS document can corrupt heap memory, potentially leading to code execution.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "libreoffice",
  "reproduction": null,
  "technical_details": "ASAN: heap-buffer-overflow WRITE of size 2 at 0x51d000009484 in ScCompiler::CompileString (compiler.cxx:4907:53). The root cause is an off-by-one: the FunctionStack heap buffer is sized to rFormula.getLength() (513), but nFunction starts at 0 and is pre-incremented once per '(' token, so 513 open-parens drive the index to 513 and pFunctionStack[513].eOp is written one element past the end of the allocation.",
  "title": "Heap-buffer-overflow in libreoffice",
  "vendor_severity": "high"
}