{"id":"CVE-2026-76181","kind":"vulnerability","aliases":["CVE-2026-76181"],"related":[],"title":"LibreOffice: crafted dBASE index file overflows heap and crashes or runs code","description":"LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.","summary":"LibreOffice's dBASE database driver reads .ndx index files from a folder used as a data source, and a crafted index can overflow a heap buffer when an index page is read. A crafted index can also make a page refer to itself so reading it recurses without end, which can crash the process.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dbase","desktop","libreoffice","package"],"not_affected_if":["no-dbase-data-sources","no-untrusted-dbase-files"],"how_to_check":"- Check whether LibreOffice is installed and its version with `soffice --version`\n- Check whether LibreOffice is used to open dBASE data sources or folders of dBASE files from untrusted origins","fix":null,"status":"open","published_at":"2026-11-05T20:17:59+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","triaged_at":"2026-11-05T20:43:26+00:00","updated_at":"2026-11-05T20:43:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T20:43:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"LibreOffice: crafted dBASE index file overflows heap and crashes or runs code","impact":"medium","summary":"LibreOffice's dBASE database driver reads .ndx index files from a folder used as a data source, and a crafted index can overflow a heap buffer when an index page is read. A crafted index can also make a page refer to itself so reading it recurses without end, which can crash the process.","audience":"everyone","category":"package","nicknames":[],"who_cares":["libreoffice","desktop","dbase"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"crafted index file can overflow heap memory or crash LibreOffice","analyst_note":"Find the fixed LibreOffice versions and whether the dBASE driver is enabled by default, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-76181 and the LibreOffice release notes.","how_to_check":"- Check whether LibreOffice is installed and its version with `soffice --version`\n- Check whether LibreOffice is used to open dBASE data sources or folders of dBASE files from untrusted origins\n- unknown for fixed version ranges: the sources do not give them","plain_action":"unknown","needs_analyst":true,"not_affected_if":["no-dbase-data-sources","no-untrusted-dbase-files"],"who_is_affected":"Affects LibreOffice installations that read dBASE tables with their .ndx index files, in particular when a folder of dBASE files is used as a data source. Systems that never open dBASE data sources are unlikely to be exposed. The sources do not name the fixed versions.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":4313,"output_tokens":616,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-76181':15A,18A 'also':59B,149C 'back':154C,191C 'buffer':48B,106C 'check':125C 'code':12A 'come':136C 'could':133C,148C 'count':173C 'craft':2A,42B,56B,146C 'crash':9A,74B 'cve':13A,16A 'data':38B,102C 'databas':26B,81C 'dbase':3A,19B,25B,80C,85C,96C 'desktop':20B 'differ':139C 'driver':27B,82C 'end':71B,163C 'entri':118C,130C,172C 'exist':108C 'field':140C 'file':5A,31B,91C,97C 'fix':165C 'folder':34B,94C 'follow':200C 'header':144C,169C 'heap':7A,47B,105C 'hold':134C,185C 'includ':78C 'index':4A,30B,43B,51B,57B,90C,111C,143C,147C,168C,182C 'libreoffic':1A,21B,23B,77C 'limit':178C 'make':60B,150C 'ndx':29B,89C 'number':116C,128C 'one':193C 'overflow':6A,45B,107C 'packag':22B 'page':52B,62B,112C,122C,132C,152C,176C,183C,188C,197C 'parent':196C 'process':76B 'read':28B,54B,67B,84C,114C,159C 'record':119C 'recurs':69B,161C 'refer':63B,153C,190C 'run':11A 'sourc':39B,103C 'tabl':86C 'use':35B,99C 'version':166C 'without':70B,162C","nicknames":[],"mitigations":[],"who_affected":"Affects LibreOffice installations that read dBASE tables with their .ndx index files, in particular when a folder of dBASE files is used as a data source. Systems that never open dBASE data sources are unlikely to be exposed. The sources do not name the fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dbase","desktop","libreoffice","medium","package"],"campaign_type":null,"first_public_at":"2026-11-05T20:17:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@documentfoundation.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76181","severity":null,"published_at":"2026-11-05T20:17:59+00:00","modified_at":"2026-11-05T20:17:59+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","fetched_at":"2026-11-05T20:40:46+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}