A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document…
[email protected]·CWE-825·Published 2026-06-15
A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.
A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.
Existía un uso después de liberación en el heap al importar los caracteres de ancho en blanco de un formato de número ODF. Un valor de posición leído del documento no se comprobaba con respecto a la longitud de la cadena de código de formato, por lo que un formato de número malformado podría procesarse contra memoria fuera de esa cadena. En las versiones corregidas, la posición se comprueba en los límites antes de su uso.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | cve.org | 7.3 | — | — | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | Primary | cve.org | 7.3 | — | — | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | Primary | cve.org | 7.3 | — | — | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | Primary | cve.org | 7.3 | — | — | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | Primary | cve.org | 7.3 | — | — | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | Secondary | NVD | 7.3 | 1.3 | 5.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| 4.0 | Primary | cve.org | 5.4 | — | — | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P |
| 4.0 | Secondary | NVD | 5.4 | — | — | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| 4.0 | Secondary | ENISA EUVD | 5.4 | — | — | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P |