Description

A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-25T14:17:25.580Z",
  "pubdate": "2026-09-25T14:17:25.580Z",
  "executiveSummary": "A critical heap use-after-free vulnerability exists in the Gnumeric spreadsheet application, specifically within its XML workbook parsing logic. The flaw is triggered when the application processes a maliciously crafted Gnumeric workbook file containing a malformed SheetObjectComponent element.\nThe vulnerability allows an attacker to manipulate the memory lifecycle of sheet-object components, leading to an invalid memory access after the object has been deallocated. Successful exploitation of this flaw can lead to application instability, resulting in a denial-of-service (crash), or potentially facilitate arbitrary code execution depending on the state of the heap at the time of the dangling pointer dereference.\nThis issue represents a significant risk to users who interact with untrusted spreadsheet documents. Exploitation does not require prior authentication, as the attack is performed locally by enticing the victim to open a specially crafted file. The vulnerability underscores the importance of memory safety in file parsing subsystems.\nAttackers can leverage this by delivering the malicious workbook via email, file sharing services, or web downloads. There are no known requirements for elevated privileges to trigger the initial crash, though further exploitation would depend on the attacker's ability to control the heap layout.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of memory pointers during the parsing of Gnumeric workbook XML files. Specifically, the vulnerability resides within the subsystem responsible for reconstructing SheetObjectComponent elements. During the deserialization or parsing phase, the XML parser invokes functions to instantiate and bind objects to the document model. Due to a logical error in the object lifecycle management, a pointer to a SheetObjectComponent is retained even after the underlying memory region has been freed or reallocated.\nThe attack flow commences when a victim opens a crafted workbook file containing a malformed SheetObjectComponent. As the Gnumeric parser processes the XML structure, it triggers the vulnerable code path that inadvertently releases the object memory while maintaining a reference to the now-dangling pointer. Subsequent logic within the parser attempts to access, modify, or dereference this pointer, expecting the memory to contain valid structure data. Because the memory is already freed or potentially occupied by different, attacker-controlled data, the application performs an invalid access operation.\nFrom an exploitation perspective, this is a classic Use-After-Free (UAF) primitive. By carefully crafting the XML input, an attacker may influence the heap allocator to place attacker-supplied data into the memory segment previously occupied by the SheetObjectComponent. If an attacker can successfully perform 'heap grooming' or 'heap spraying' to replace the freed object with a malicious payload, they can control the function pointers or object attributes that the application dereferences.\nWhen the program eventually dereferences the dangling pointer, it may execute code residing at an address dictated by the attacker's heap data, potentially leading to arbitrary code execution. If the memory is simply inaccessible, the outcome is a segmentation fault or memory access violation, leading to a crash. This vulnerability is triggered without requiring network exposure or authentication, as it relies on the local parsing of a document provided by the user. The impact is limited to the process context of the Gnumeric user, but could be severe if the user maintains high-privilege access or the application has access to sensitive files."
}