Crafted dBASE index data can overflow LibreOffice memory when a database document references it. Update the 26.2 branch to 26.2.6+ or 26.8 to 26.8.1+. ZDI describes code execution with user interaction; the vendor scores the same flaw 5.4 under CVSS 4.0. No confirmed attacks are established by these notices.
The affected driver reads dBASE tables and their index files when a folder is used as a database source. A crafted page can claim more entries than its allocation permits, or point back to a parent. The fixes bound entry counts and reject recursive page chains.
The vendor and ZDI describe the same vulnerability with different scoring systems and impact emphasis; their scores are not interchangeable. L3 reflects a mainstream document parser and ZDI’s credible code-execution assessment with user interaction, rather than a confirmed campaign or universal exposure of every document format. No complete range for older unsupported branches is established here; move those installations to a maintained fixed release.
CVE-2026-76181CVSS 5.4Unchecked index-page entry counts can overflow a heap buffer; cyclic page references can also cause uncontrolled recursion. Vendor CVSS 4.0 is 5.4; ZDI gives a separate 7.8 score and describes code execution in the current process.
| Product | Safe from | Note |
|---|---|---|
| LibreOffice 26.2 | 26.2.6 | |
| LibreOffice 26.8 | 26.8.1 |
Nov 5, 2026
The Document Foundation announces the flaw and fixed versions
Nov 6, 2026
ZDI publishes its coordinated researcher advisory
ZDI-26-895 describes a malicious .odb reference to dBASE index data, requiring the target to open malicious content.
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.