CVE-2026-8358

LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected.

• CWE-787
• CWE-843

• https://www.libreoffice.org/about-us/security/advisories/cve-2026-8358

Published

Jun 15, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-83555The Email Subscribers & Newsletters WordPress plugin before…5.3
• CVE-2026-83557DefaultBaseTypeLimitingValidator is the PolymorphicTypeValid…5.6
• CVE-2026-8356LibreOffice can import presentations in the legacy binary PP…5.4
• CVE-2026-83561The Complianz GDPR/CCPA Cookie Consent Banner plugin for Wor…7.2
• CVE-2026-83562Contributor Cross Site Scripting (XSS) in WCFM Marketplace <…6.5
• CVE-2026-8357LibreOffice Calc compiles cell formulas when opening a sprea…7.8
• CVE-2026-8359When processing a request with a URL path starting with /sta…7.5
• CVE-2026-83591The AMP for WP – Accelerated Mobile Pages plugin for WordPre…7.2
• CVE-2026-83593The WPBot – AI ChatBot for Live Support, Lead Generation, AI…7.2
• CVE-2026-83595AVideo contains a cross-site request forgery vulnerability i…8.1
• CVE-2026-83596A flaw was found in WebKitGTK. Processing malicious web cont…8.8
• CVE-2026-83597Netdata is an open source observability tool. From version 2…7