*** This bug is a security vulnerability ***

Public security bug reported:

CVE-2026-4430: "Heap Buffer Overflow in AgileEngine"

Out-of-bounds write vulnerability in The Document Foundation LibreOffice
via crafted OOXML documents with mismatched encryption salt parameters.

https://ubuntu.com/security/CVE-2026-4430

* Resolute 26.04: Fix is included in 26.2.3 SRU
  - https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/2150525
* Questing 25.10: Fix is included in 25.8.7 SRU
  - https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/2150734
* Noble 24.04: Backport of patch to 24.2.7 required
  - 
https://git.launchpad.net/~libreoffice/ubuntu/+source/libreoffice/log/?h=wip/noble-24.2
* Jammy 22.04: Backport of patch to 7.3.7 required
  - 
https://git.launchpad.net/~libreoffice/ubuntu/+source/libreoffice/log/?h=wip/jammy-7.3

** Affects: libreoffice (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: libreoffice (Ubuntu Jammy)
     Importance: High
     Assignee: Rico Tzschichholz (ricotz)
         Status: New

** Affects: libreoffice (Ubuntu Noble)
     Importance: High
     Assignee: Rico Tzschichholz (ricotz)
         Status: New

** CVE added: https://cve.org/CVERecord?id=CVE-2026-4430

** Also affects: libreoffice (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: libreoffice (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Changed in: libreoffice (Ubuntu Jammy)
   Importance: Undecided => High

** Changed in: libreoffice (Ubuntu Noble)
   Importance: Undecided => High

** Changed in: libreoffice (Ubuntu Jammy)
     Assignee: (unassigned) => Rico Tzschichholz (ricotz)

** Changed in: libreoffice (Ubuntu Noble)
     Assignee: (unassigned) => Rico Tzschichholz (ricotz)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2152251

Title:
  CVE-2026-4430

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/2152251/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to