Key points
- LibreOffice has released an update to fix CVE-2026-6045, a remote code execution flaw.
- The vulnerability exists in the parsing of EMF images within ODT files.
- Attackers must trick users into opening a malicious file or visiting a bad page.
LibreOffice has issued a security update to correct a high-severity vulnerability identified as CVE-2026-6045. According to the Zero Day Initiative advisory ZDI-26-781, this flaw allows remote attackers to execute arbitrary code on affected installations. The issue stems from improper validation of user-supplied data during the parsing of EMF images embedded in ODT documents. This lack of validation can result in an integer overflow before a buffer is allocated, enabling code execution in the context of the current process.
In plain English
The problem occurs when LibreOffice tries to read specific image formats inside document files. The software does not check the size of the data correctly before setting aside memory for it. This miscalculation causes an integer overflow, which attackers can manipulate to run their own programs on your computer. The Zero Day Initiative rates this vulnerability at a CVSS score of 7.8, classifying it as high severity. While the flaw allows remote code execution, it is not fully automatic.
The background
Exploiting this vulnerability requires direct user interaction. According to the Zero Day Initiative, a target must either visit a malicious webpage or open a malicious file to trigger the attack. The vendor was notified of the vulnerability on April 23, 2026. The coordinated public release of the advisory and the fix occurred on October 16, 2026. This timeline mirrors other recent high-severity patches, such as the TuxGuitar and Docker Buildx updates also released on October 16, 2026, which addressed similar remote code execution risks.
What changes now
LibreOffice has confirmed that an update is available to correct this vulnerability. Users should apply this update to their installations as soon as possible. The fix addresses the integer overflow issue in the EMF image parser. Applying the patch removes the ability for attackers to leverage this specific flaw to run arbitrary code. Organizations should verify that all endpoints have received the latest version of the software to ensure protection against this threat.
Who needs to act first
Teams usually prioritize systems that handle external documents, such as customer support or marketing servers, since these face the highest exposure to malicious files. Check whether your network allows email attachments from unknown sources, as these are common delivery methods. Roll out the update to a small group of non-critical machines first to ensure stability before a wider deployment. Back up important data before applying any software changes to prevent potential loss. Monitor logs for unusual process activity that might indicate an attempt to exploit unpatched systems.
What to do and how to stay safe: LibreOffice
- Verify that your LibreOffice installation is updated to the latest version provided by the vendor.
- Configure email and file-sharing systems to scan incoming attachments for malicious content.
- Educate users to avoid opening unexpected documents or visiting suspicious links.
- Monitor system logs for unauthorized process executions that could signal an exploit attempt.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is a fix available for CVE-2026-6045?
Yes, LibreOffice has issued an update to correct this vulnerability.
How is this vulnerability exploited?
User interaction is required; the target must open a malicious file or visit a malicious page.
What is the severity rating of this flaw?
The Zero Day Initiative has assigned a CVSS rating of 7.8.
