CVE-2026-4430

Think of LibreOffice like software for reading office documents. This bug can be activated only when someone opens a “maliciously made” document, and it may cause the computer running LibreOffice to be compromised in serious ways—similar to a booby-trapped document that tricks the program into writing past its safe memory limits.

This matters if you run LibreOffice on any machines where users open office documents, especially documents from email or the internet. It requires user interaction (someone opening the crafted document) and does not require the attacker to have a login. Based on the findings, it’s a risk specifically when the vulnerable LibreOffice version processes an attacker-prepared OOXML document (reachable depends on whether that feature/use is used, but the direct trigger is opening the malicious document).

This is an AMBER issue because it can lead to serious outcomes (including potential code execution) and relies on a common user action: opening documents. There is no confirmed public exploit code recorded and it is not listed in KEV, so the immediate “everyone is being hit today” signal is lower—but you should still upgrade promptly to remove the risk.