Description

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-11-05T20:17:59.693Z",
  "pubdate": "2026-11-05T20:17:59.693Z",
  "executiveSummary": "LibreOffice contains a critical heap-based buffer overflow vulnerability within its dBASE database driver component. The flaw arises from improper input validation when processing .ndx index files, specifically concerning the parsing of index page structures. An attacker capable of providing a specially crafted dBASE data source can trigger this memory corruption, potentially leading to arbitrary code execution or a denial-of-service condition through application crashing. The vulnerability also facilitates infinite recursion, resulting in resource exhaustion via stack overflow if the indexing logic is forced to traverse self-referencing page structures. This vulnerability poses a significant risk to end-users who may be prompted to open malicious database files, as it requires no specific authentication or elevated privileges, relying solely on the user interacting with a compromised file structure.",
  "technicalDetails": "The vulnerability originates in the LibreOffice dBASE driver, which is responsible for parsing dBASE tables and their corresponding .ndx index files. The core of the issue lies in a failure to perform bounds checking on the 'number of entries' field located within the index header relative to the actual storage capacity defined by the page structure.\nDuring the parsing process, the driver reads the index header and subsequently allocates heap memory based on the page parameters. Because the implementation neglects to cross-reference the number of recorded entries against the physical constraints of the index page, an attacker can supply a malformed header that specifies an entry count exceeding the allocated heap buffer size. When the application attempts to populate the structure with entries, a heap-based buffer overflow occurs. This memory corruption allows an attacker to overwrite adjacent heap metadata or application data, potentially redirecting control flow if sensitive structures are mangled.\nFurthermore, the driver fails to implement adequate cycle detection during the traversal of index pages. A crafted .ndx file can define a page hierarchy where a child node refers back to one of its parent nodes or itself. This logical flaw causes the parsing function to enter an infinite recursion loop. Because each recursive call consumes stack frames, this leads to an unconstrained growth in stack memory usage, ultimately resulting in a stack overflow and a hard crash of the application process.\nThe attack flow begins when a user is convinced to treat a directory containing the weaponized .ndx file as a data source within LibreOffice. Upon initialization or access of the database, the driver parses the malicious header, triggering the heap overflow or the infinite recursion. This attack is inherently client-side, requiring no network connectivity if the file is local, or potentially via network shares. There are no authentication requirements, as the vulnerability is triggered by the standard functionality of the database driver upon parsing a document. The successful exploitation of the heap overflow provides a vector for code execution within the context of the current user, while the recursive flaw provides a reliable denial-of-service vector."
}