CVE-2026-6040
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk2th percentile — higher than 2% of all known CVEs
Summary
A heap use-after-free vulnerability exists when importing zero-width characters from an ODF number format. A position value read from the document was not validated against the length of the format-code string, allowing a malformed number format to be processed against memory outside that string. In fixed versions, the position is bounds-checked before use.
Risk Assessment
The risk involves potential remote code execution or memory disclosure through a crafted ODF document, which could compromise system confidentiality and integrity.
Recommendation
Immediately update to a version containing the fix that validates the position before use. Also avoid opening ODF documents from untrusted sources.
Original NVD description (English source)
A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.