ECHO-5250-fd80-297a
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-5250-fd80-297a.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-5250-fd80-297a
- Upstream
- CVE-2026-6047
- Withdrawn
- 2026-09-29T11:00:03Z
- Published
- 2026-06-16T14:17:51Z
- Modified
- 2026-09-29T11:45:37Z
- Summary
- Heap buffer overflow when replaying deferred OOXML parser events for a text box element, fixed upstream in LibreOffice 25.8.7 and 26.2.3. Debian trixie ships LibreOffice 25.2.3, which does not contain the vulnerable code: the Debian security team marks trixie (and bookworm) as not-affected ("Vulnerable code not present"). No Echo patch is required. Re-evaluate if this spec is ever rebased to a newer LibreOffice release that predates the upstream fix. https://security-tracker.debian.org/tracker/CVE-2026-6047
- Details
- References