---
id: "CVE-2026-76181"
kind: "vulnerability"
aliases: ["CVE-2026-76181"]
title: "LibreOffice: crafted dBASE index file overflows heap and crashes or runs code"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dbase", "desktop", "libreoffice", "package"]
not_affected_if: ["no-dbase-data-sources", "no-untrusted-dbase-files"]
published_at: "2026-11-05T20:17:59+00:00"
first_seen_at: "2026-11-05T20:40:46+00:00"
updated_at: "2026-11-05T20:43:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76181", "first_seen_at": "2026-11-05T20:40:46+00:00"}]
exploit_sources: []
---

# LibreOffice: crafted dBASE index file overflows heap and crashes or runs code

LibreOffice's dBASE database driver reads .ndx index files from a folder used as a data source, and a crafted index can overflow a heap buffer when an index page is read. A crafted index can also make a page refer to itself so reading it recurses without end, which can crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether LibreOffice is installed and its version with `soffice --version`
- Check whether LibreOffice is used to open dBASE data sources or folders of dBASE files from untrusted origins

## Timeline

- 2026-11-05T20:40:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76181

## From the sources

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_