{"id":"SUSE-SU-2026:3140-1","summary":"Security update for libreoffice","details":"This update for libreoffice fixes the following issues:\n\nUpdate to LibreOffice 26.2.5.1.\n\nSecurity issues fixed:\n\n- CVE-2026-4430: out-of-bounds write via crafted OOXML documents with mismatched encryption salt parameters\n  (bsc#1264357).\n- CVE-2026-6039: denial of service via specially crafted DXF polyline import (bsc#1268494).\n- CVE-2026-6040: heap use-after-free when importing the blank-width characters of an ODF number format (bsc#1268527).\n- CVE-2026-6045: heap buffer overflow via crafted EMF+ graphics import (bsc#1268497).\n- CVE-2026-6047: denial of service via heap buffer overflow in OOXML document processing (bsc#1268504).\n- CVE-2026-8356: denial of service via a specially crafted PPT file (bsc#1268522).\n- CVE-2026-8357: heap buffer overflow in Calc formula compilation (bsc#1268528).\n- CVE-2026-8358: heap buffer overflow in spreadsheet tracked-changes import (bsc#1268529).\n- CVE-2026-50593: graphite2: out-of-bounds write via Graphite actions (bsc#1267735).\n\nOther updates and bugfixes:\n\n- Update to LibreOffice 26.2.5.1.\n  - Update bundled dependencies:\n    * `fontconfig` 2.17.1 -\u003e 2.18.0\n    * `graphite2-minimal` 1.3.14 -\u003e 1.3.15\n    * `libcmis` 0.6.2 -\u003e 0.6.3\n    * `libgpg-error` 1.59 -\u003e 1.61\n    * `lxml` 6.1.0 -\u003e 6.1.1\n    * `md4c` 0.5.2 -\u003e 0.5.3\n    * `poppler` 26.04.0 -\u003e 26.06.0\n    * `sqlite-amalgamation` 3530000 -\u003e 3530100\n    * `xmlsec1` 1.3.9 -\u003e 1.3.11\n- Update to LibreOffice 26.2.3.2 (PED-16098).\n  - Upgraded dependencies:\n    * `boost`: 1_88_0 -\u003e 1_89_0\n    * `freetype`: 2.14.1 -\u003e 2.14.3\n    * `harfbuzz`: 12.3.0 -\u003e 12.3.2\n    * `icu4c`: 77_1 -\u003e 78.3\n    * `libgpg-error`: 1.56 -\u003e 1.59\n    * `liborcus`: 0.20.1 -\u003e 0.21.0\n    * `pdfium`: 7012 -\u003e 7471\n    * `poppler`: 25.12.0 -\u003e 26.04.0\n    * `skia`: m136 -\u003e m142\n  - New bundled sources:\n    * `afdko` 4.0.3\n    * `antlr4-cpp-runtime` 4.13.2\n    * `fast_float` 8.2.2\n    * `libffi` 3.5.2\n    * `lxml` 6.1.0\n    * `md4c` 0.5.2\n    * `meson` 1.8.3\n    * `Python` 3.12.13\n    * `sqlite` 3530000\n    * `xmlsec1` 1.3.9\n    * `xz` 5.8.3\n- Add `patch`, required to build the bundled Python on all architectures.\n- Bundling a specific Python is now required as the one we ship (3.6) is too old to build `harfbuzz`.\n","modified":"2026-07-21T09:45:06.737566804Z","published":"2026-07-20T18:01:16Z","related":["CVE-2026-4430","CVE-2026-50593","CVE-2026-6039","CVE-2026-6040","CVE-2026-6045","CVE-2026-6047","CVE-2026-8356","CVE-2026-8357","CVE-2026-8358"],"upstream":["CVE-2026-4430","CVE-2026-50593","CVE-2026-6039","CVE-2026-6040","CVE-2026-6045","CVE-2026-6047","CVE-2026-8356","CVE-2026-8357","CVE-2026-8358"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263140-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264357"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267735"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268494"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268497"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268504"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268522"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268527"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268528"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268529"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-4430"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-50593"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6039"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6040"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6045"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6047"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-8356"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-8357"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-8358"}],"affected":[{"package":{"name":"libreoffice","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","purl":"pkg:rpm/suse/libreoffice&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.1-150500.20.37.1"}]}],"ecosystem_specific":{"binaries":[{"libreoffice-l10n-st":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sw_TZ":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ca":"26.2.5.1-150500.20.37.1","libreoffice-l10n-hsb":"26.2.5.1-150500.20.37.1","libreoffice-l10n-kok":"26.2.5.1-150500.20.37.1","libreoffice-l10n-tn":"26.2.5.1-150500.20.37.1","libreoffice-l10n-el":"26.2.5.1-150500.20.37.1","libreoffice-l10n-hi":"26.2.5.1-150500.20.37.1","libreoffice-l10n-rw":"26.2.5.1-150500.20.37.1","libreoffice-l10n-gu":"26.2.5.1-150500.20.37.1","libreoffice-l10n-am":"26.2.5.1-150500.20.37.1","libreoffice-l10n-mr":"26.2.5.1-150500.20.37.1","libreoffice-l10n-lt":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ast":"26.2.5.1-150500.20.37.1","libreoffice-sdk-doc":"26.2.5.1-150500.20.37.1","libreoffice-l10n-eu":"26.2.5.1-150500.20.37.1","libreoffice-l10n-en":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ka":"26.2.5.1-150500.20.37.1","libreoffice-glade":"26.2.5.1-150500.20.37.1","libreoffice-l10n-dz":"26.2.5.1-150500.20.37.1","libreoffice-l10n-zh_CN":"26.2.5.1-150500.20.37.1","libreoffice-l10n-tr":"26.2.5.1-150500.20.37.1","libreoffice-l10n-brx":"26.2.5.1-150500.20.37.1","libreoffice-l10n-es":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ve":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ks":"26.2.5.1-150500.20.37.1","libreoffice-l10n-hr":"26.2.5.1-150500.20.37.1","libreoffice-l10n-bn":"26.2.5.1-150500.20.37.1","libreoffice-calc":"26.2.5.1-150500.20.37.1","libreoffice-l10n-vec":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ca_valencia":"26.2.5.1-150500.20.37.1","libreoffice-l10n-zu":"26.2.5.1-150500.20.37.1","libreoffice-l10n-szl":"26.2.5.1-150500.20.37.1","libreoffice-l10n-cy":"26.2.5.1-150500.20.37.1","libreoffice-l10n-be":"26.2.5.1-150500.20.37.1","libreoffice-l10n-pl":"26.2.5.1-150500.20.37.1","libreoffice-l10n-dsb":"26.2.5.1-150500.20.37.1","libreoffice-gdb-pretty-printers":"26.2.5.1-150500.20.37.1","libreoffice-l10n-id":"26.2.5.1-150500.20.37.1","libreoffice-l10n-dgo":"26.2.5.1-150500.20.37.1","libreoffice-l10n-br":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sd":"26.2.5.1-150500.20.37.1","libreoffice":"26.2.5.1-150500.20.37.1","libreoffice-l10n-it":"26.2.5.1-150500.20.37.1","libreoffice-l10n-om":"26.2.5.1-150500.20.37.1","libreoffice-l10n-kn":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ko":"26.2.5.1-150500.20.37.1","libreofficekit-devel":"26.2.5.1-150500.20.37.1","libreoffice-l10n-eo":"26.2.5.1-150500.20.37.1","libreoffice-base-drivers-postgresql":"26.2.5.1-150500.20.37.1","libreoffice-draw":"26.2.5.1-150500.20.37.1","libreoffice-l10n-uk":"26.2.5.1-150500.20.37.1","libreoffice-l10n-en_GB":"26.2.5.1-150500.20.37.1","libreoffice-l10n-pa":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sid":"26.2.5.1-150500.20.37.1","libreoffice-gnome":"26.2.5.1-150500.20.37.1","libreoffice-branding-upstream":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ml":"26.2.5.1-150500.20.37.1","libreoffice-l10n-zh_TW":"26.2.5.1-150500.20.37.1","libreoffice-l10n-et":"26.2.5.1-150500.20.37.1","libreoffice-l10n-mk":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sl":"26.2.5.1-150500.20.37.1","libreoffice-math":"26.2.5.1-150500.20.37.1","libreoffice-l10n-en_ZA":"26.2.5.1-150500.20.37.1","libreoffice-l10n-nn":"26.2.5.1-150500.20.37.1","libreofficekit":"26.2.5.1-150500.20.37.1","libreoffice-mailmerge":"26.2.5.1-150500.20.37.1","libreoffice-gtk3":"26.2.5.1-150500.20.37.1","libreoffice-l10n-gd":"26.2.5.1-150500.20.37.1","libreoffice-l10n-kk":"26.2.5.1-150500.20.37.1","libreoffice-l10n-de":"26.2.5.1-150500.20.37.1","libreoffice-l10n-hu":"26.2.5.1-150500.20.37.1","libreoffice-l10n-tt":"26.2.5.1-150500.20.37.1","libreoffice-icon-themes":"26.2.5.1-150500.20.37.1","libreoffice-l10n-da":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ckb":"26.2.5.1-150500.20.37.1","libreoffice-base":"26.2.5.1-150500.20.37.1","libreoffice-l10n-cs":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ta":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ts":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sr":"26.2.5.1-150500.20.37.1","libreoffice-l10n-km":"26.2.5.1-150500.20.37.1","libreoffice-l10n-my":"26.2.5.1-150500.20.37.1","libreoffice-l10n-pt_PT":"26.2.5.1-150500.20.37.1","libreoffice-l10n-as":"26.2.5.1-150500.20.37.1","libreoffice-l10n-lo":"26.2.5.1-150500.20.37.1","libreoffice-qt5":"26.2.5.1-150500.20.37.1","libreoffice-l10n-pt_BR":"26.2.5.1-150500.20.37.1","libreoffice-sdk":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sat":"26.2.5.1-150500.20.37.1","libreoffice-impress":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ne":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ro":"26.2.5.1-150500.20.37.1","libreoffice-l10n-gug":"26.2.5.1-150500.20.37.1","libreoffice-l10n-tg":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ar":"26.2.5.1-150500.20.37.1","libreoffice-l10n-fy":"26.2.5.1-150500.20.37.1","libreoffice-l10n-gl":"26.2.5.1-150500.20.37.1","libreoffice-l10n-nso":"26.2.5.1-150500.20.37.1","libreoffice-filters-optional":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ss":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ug":"26.2.5.1-150500.20.37.1","libreoffice-l10n-fi":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ru":"26.2.5.1-150500.20.37.1","libreoffice-calc-extensions":"26.2.5.1-150500.20.37.1","libreoffice-l10n-mni":"26.2.5.1-150500.20.37.1","libreoffice-l10n-nr":"26.2.5.1-150500.20.37.1","libreoffice-l10n-bs":"26.2.5.1-150500.20.37.1","libreoffice-writer-extensions":"26.2.5.1-150500.20.37.1","libreoffice-l10n-xh":"26.2.5.1-150500.20.37.1","libreoffice-pyuno":"26.2.5.1-150500.20.37.1","libreoffice-l10n-si":"26.2.5.1-150500.20.37.1","libreoffice-l10n-fa":"26.2.5.1-150500.20.37.1","libreoffice-l10n-nl":"26.2.5.1-150500.20.37.1","libreoffice-l10n-kab":"26.2.5.1-150500.20.37.1","libreoffice-l10n-af":"26.2.5.1-150500.20.37.1","libreoffice-l10n-bo":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sa_IN":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sv":"26.2.5.1-150500.20.37.1","libreoffice-l10n-fr":"26.2.5.1-150500.20.37.1","libreoffice-l10n-or":"26.2.5.1-150500.20.37.1","libreoffice-l10n-mn":"26.2.5.1-150500.20.37.1","libreoffice-l10n-vi":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ga":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sq":"26.2.5.1-150500.20.37.1","libreoffice-l10n-lv":"26.2.5.1-150500.20.37.1","libreoffice-l10n-kmr_Latn":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ja":"26.2.5.1-150500.20.37.1","libreoffice-l10n-nb":"26.2.5.1-150500.20.37.1","libreoffice-base-drivers-firebird":"26.2.5.1-150500.20.37.1","libreoffice-writer":"26.2.5.1-150500.20.37.1","libreoffice-l10n-bg":"26.2.5.1-150500.20.37.1","libreoffice-officebean":"26.2.5.1-150500.20.37.1","libreoffice-l10n-th":"26.2.5.1-150500.20.37.1","libreoffice-l10n-oc":"26.2.5.1-150500.20.37.1","libreoffice-librelogo":"26.2.5.1-150500.20.37.1","libreoffice-l10n-fur":"26.2.5.1-150500.20.37.1","libreoffice-l10n-he":"26.2.5.1-150500.20.37.1","libreoffice-l10n-te":"26.2.5.1-150500.20.37.1","libreoffice-l10n-mai":"26.2.5.1-150500.20.37.1","libreoffice-l10n-lb":"26.2.5.1-150500.20.37.1","libreoffice-l10n-is":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sk":"26.2.5.1-150500.20.37.1","libreoffice-l10n-bn_IN":"26.2.5.1-150500.20.37.1","libreoffice-l10n-uz":"26.2.5.1-150500.20.37.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3140-1.json"}},{"package":{"name":"libreoffice","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","purl":"pkg:rpm/suse/libreoffice&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.1-150500.20.37.1"}]}],"ecosystem_specific":{"binaries":[{"libreoffice-l10n-eu":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ta":"26.2.5.1-150500.20.37.1","libreoffice-l10n-es":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ss":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ca":"26.2.5.1-150500.20.37.1","libreoffice-l10n-uk":"26.2.5.1-150500.20.37.1","libreoffice-l10n-da":"26.2.5.1-150500.20.37.1","libreoffice-l10n-mai":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ru":"26.2.5.1-150500.20.37.1","libreoffice-l10n-bg":"26.2.5.1-150500.20.37.1","libreoffice-l10n-bn":"26.2.5.1-150500.20.37.1","libreoffice-l10n-hr":"26.2.5.1-150500.20.37.1","libreoffice-l10n-hi":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ml":"26.2.5.1-150500.20.37.1","libreoffice-l10n-de":"26.2.5.1-150500.20.37.1","libreoffice-pyuno":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ts":"26.2.5.1-150500.20.37.1","libreoffice-impress":"26.2.5.1-150500.20.37.1","libreoffice-l10n-nr":"26.2.5.1-150500.20.37.1","libreoffice-gtk3":"26.2.5.1-150500.20.37.1","libreoffice-l10n-kn":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ja":"26.2.5.1-150500.20.37.1","libreoffice-l10n-cs":"26.2.5.1-150500.20.37.1","libreoffice-l10n-or":"26.2.5.1-150500.20.37.1","libreoffice-l10n-pa":"26.2.5.1-150500.20.37.1","libreoffice-l10n-mr":"26.2.5.1-150500.20.37.1","libreoffice-l10n-tn":"26.2.5.1-150500.20.37.1","libreoffice-l10n-fur":"26.2.5.1-150500.20.37.1","libreoffice-l10n-fr":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ko":"26.2.5.1-150500.20.37.1","libreoffice-l10n-lv":"26.2.5.1-150500.20.37.1","libreoffice-l10n-zu":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ro":"26.2.5.1-150500.20.37.1","libreoffice-l10n-nso":"26.2.5.1-150500.20.37.1","libreoffice-l10n-gl":"26.2.5.1-150500.20.37.1","libreoffice-l10n-nn":"26.2.5.1-150500.20.37.1","libreoffice-base":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ar":"26.2.5.1-150500.20.37.1","libreoffice-l10n-gu":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ckb":"26.2.5.1-150500.20.37.1","libreoffice-mailmerge":"26.2.5.1-150500.20.37.1","libreoffice-l10n-nb":"26.2.5.1-150500.20.37.1","libreoffice-l10n-hy":"26.2.5.1-150500.20.37.1","libreoffice-l10n-cy":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ga":"26.2.5.1-150500.20.37.1","libreoffice-l10n-pt_BR":"26.2.5.1-150500.20.37.1","libreoffice-l10n-st":"26.2.5.1-150500.20.37.1","libreoffice-l10n-zh_TW":"26.2.5.1-150500.20.37.1","libreoffice-l10n-ve":"26.2.5.1-150500.20.37.1","libreoffice-l10n-xh":"26.2.5.1-150500.20.37.1","libreoffice-l10n-hu":"26.2.5.1-150500.20.37.1","libreoffice-math":"26.2.5.1-150500.20.37.1","libreoffice-calc":"26.2.5.1-150500.20.37.1","libreoffice-l10n-en":"26.2.5.1-150500.20.37.1","libreoffice-l10n-nl":"26.2.5.1-150500.20.37.1","libreoffice-l10n-pt_PT":"26.2.5.1-150500.20.37.1","libreoffice-l10n-th":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sl":"26.2.5.1-150500.20.37.1","libreoffice-draw":"26.2.5.1-150500.20.37.1","libreoffice-l10n-tr":"26.2.5.1-150500.20.37.1","libreoffice-icon-themes":"26.2.5.1-150500.20.37.1","libreoffice-gnome":"26.2.5.1-150500.20.37.1","libreoffice-writer":"26.2.5.1-150500.20.37.1","libreoffice-l10n-si":"26.2.5.1-150500.20.37.1","libreofficekit":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sr":"26.2.5.1-150500.20.37.1","libreoffice-writer-extensions":"26.2.5.1-150500.20.37.1","libreoffice":"26.2.5.1-150500.20.37.1","libreoffice-l10n-dz":"26.2.5.1-150500.20.37.1","libreoffice-l10n-af":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sk":"26.2.5.1-150500.20.37.1","libreoffice-l10n-as":"26.2.5.1-150500.20.37.1","libreoffice-officebean":"26.2.5.1-150500.20.37.1","libreoffice-l10n-eo":"26.2.5.1-150500.20.37.1","libreoffice-l10n-fi":"26.2.5.1-150500.20.37.1","libreoffice-l10n-lt":"26.2.5.1-150500.20.37.1","libreoffice-base-drivers-postgresql":"26.2.5.1-150500.20.37.1","libreoffice-l10n-fa":"26.2.5.1-150500.20.37.1","libreoffice-filters-optional":"26.2.5.1-150500.20.37.1","libreoffice-l10n-te":"26.2.5.1-150500.20.37.1","libreoffice-l10n-sv":"26.2.5.1-150500.20.37.1","libreoffice-l10n-pl":"26.2.5.1-150500.20.37.1","libreoffice-l10n-it":"26.2.5.1-150500.20.37.1","libreoffice-calc-extensions":"26.2.5.1-150500.20.37.1","libreoffice-l10n-el":"26.2.5.1-150500.20.37.1","libreoffice-l10n-he":"26.2.5.1-150500.20.37.1","libreoffice-l10n-br":"26.2.5.1-150500.20.37.1","libreoffice-l10n-et":"26.2.5.1-150500.20.37.1","libreoffice-branding-upstream":"26.2.5.1-150500.20.37.1","libreoffice-l10n-kk":"26.2.5.1-150500.20.37.1","libreoffice-l10n-zh_CN":"26.2.5.1-150500.20.37.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3140-1.json"}}],"schema_version":"1.7.5"}