ANT-2026-YN5QG0SH · libreoffice

heap-buffer-overflow medium

CVE-2026-8358

Severity Claude critical · Security research firm high · Maintainer medium

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-YN5QG0SH: Heap-buffer-overflow in libreoffice

The fods2xlsfuzzer libFuzzer harness terminated with EXIT_CODE:1 when executing the supplied PoC input. No AddressSanitizer, UBSan, or other sanitizer report was printed, so the crash type, faulting function, and memory-access shape cannot be determined from this log alone. The harness name indicates the input is likely a crafted FODS (Flat ODF Spreadsheet) document processed through a FODS-to-XLS conversion code path.

Target

Project: libreoffice

Technical Details

ASAN: heap-buffer-overflow WRITE of size N at offset 64 bytes past a 168-byte heap region. The root cause is a type confusion: the change-tracking import path assumes an action referenced as a 'previous content' is a ScChangeActionContent, but id collisions in the XML allow a smaller ScChangeActionIns object to occupy that slot. The subsequent static_cast and field store in SetPrevContent land outside the allocated object.

Crash trace:

INFO: found LLVMFuzzerCustomMutator (0x64e5afcdb8d0). Disabling -len_control by default.
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 4243907513
INFO: Loaded 1 modules   (2649413 inline 8-bit counters): 2649413 [0x64e5c1298538, 0x64e5c151f27d), 
INFO: Loaded 1 PC tables (2649413 PCs): 2649413 [0x64e5c151f280,0x64e5c3d8c6d0), 
/out/fods2xlsfuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1

Reproduction

Reproduce against the target as described under Technical Details.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-YN5QG0SH.

Reference: ANT-2026-YN5QG0SH
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict
true positive
Severity
high
TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-24 Reported to tracker
  2. 2026-05-07 Sent to maintainer
  3. 2026-05-12 Maintainer acknowledged
  4. 2026-06-14 Patch released
  5. 2026-07-08 Publicly revealed
PROVENANCE

SHA-3-512 hash:

75d28320b6e877540eeae0b627595ba3b0ba9bb31397195518cc558cd1b0e0a4a446d9fea90f82d5a3e19ebe5023e6a5a04d9a85eb1a0def4d2e9fceb2cab9e0

Committed 2026-05-07 03:18 PT

Revealed 2026-07-08 16:29 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-YN5QG0SH",
  "bug_class": "Heap-buffer-overflow",
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-03-24T18:46:34+00:00",
  "description": "The fods2xlsfuzzer libFuzzer harness terminated with EXIT_CODE:1 when executing the supplied PoC input. No AddressSanitizer, UBSan, or other sanitizer report was printed, so the crash type, faulting function, and memory-access shape cannot be determined from this log alone. The harness name indicates the input is likely a crafted FODS (Flat ODF Spreadsheet) document processed through a FODS-to-XLS conversion code path.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "libreoffice",
  "reproduction": null,
  "technical_details": null,
  "title": "Heap-buffer-overflow in libreoffice",
  "vendor_severity": "high"
}