Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-76181— Heap buffer overflow in dBASE index import

Quick assessment

Affected
The Document Foundation LibreOffice
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LibreOffice 包含一个 dBASE 数据库驱动程序，当将包含 dBASE 文件的文件夹用作数据源时，该驱动会读取 dBASE 表及其对应的 .ndx 索引文件。在读取索引页时存在堆缓冲区溢出漏洞：程序未将索引页中记录的条目数量与该页实际可容纳的条目数量（该容量信息来自索引头的另一个字段）进行校验。此外，精心构造的索引还可使某个页指向自身，导致读取过程陷入无限递归。在已修复的版本中，索引头及每个页的条目数量均被限制为索引页所能容纳的最大值；同时，若某页指向其父级页之一，则不再继续跟随该引用。

CVSS 5.4 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76181

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Heap buffer overflow in dBASE index import
Source: CVE Program / CVE List V5
Vulnerability Description
LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
The Document Foundation LibreOffice 26.2 ~ < 26.2.6 -

II. Public POCs for CVE-2026-76181

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76181

请登录查看更多情报信息。

Other References for CVE-2026-76181 (1)

IV. Related Vulnerabilities

Same product: LibreOffice
Same vendor: The Document Foundation
Same weakness: CWE-787