LibreOffice Patches dBase RCE: Heap Overflow in Index Files Discovered by Hybrid AI-Human Team

On November 6, 2026, LibreOffice publicly disclosed the fix for CVE-2026-76181, a remote code execution vulnerability in dBase index file parsing. The discovery is credited to Claude, Anthropic's agent-based system, and Ada Logics, with validation and coordination by an anonymous researcher at TrendAI Zero Day Initiative and patch development by Caolán McNamara of Collabora Productivity.

The Mechanism: How a Crafted dBase Index Compromises LibreOffice

The flaw lies in the failure to validate the number of entries in an index page against the capacity declared in the header. According to the official CVE Record, "the number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header."

Advisory ZDI-26-895 adds that "the specific flaw exists within the parsing of dBase index files, which can be referenced from .odb database files." A seemingly legitimate .odb file can therefore serve as a vector, embedding a manipulated .ndx index.

Beyond the overflow, the CVE Record documents a structural side effect: "a crafted index could also make a page refer back to itself, so that reading it recursed without end." The infinite recursion is documented as a structural consequence of the faulty parsing, not as a separate attack vector with independent DoS impact.

Discovery and the Human Validation Chain

The vendor report occurred on August 20, 2026; coordinated publication followed on November 6, 2026. The nearly 78-day window between report and disclosure is noted in primary sources without documented rationale.

Credits in the CVE Record show a hybrid chain: Claude (Anthropic, agent-based) and Ada Logics for initial discovery; an anonymous researcher with TrendAI Zero Day Initiative for coordinated disclosure; and Caolán McNamara of Collabora Productivity for fix development. The AI agent is the finder, not the sole discoverer: validation and disclosure management were conducted by human actors.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file."
— TrendAI Zero Day Initiative Advisory ZDI-26-895

The CVSS Discrepancy: Why the Scores Don't Match

The official CVE Record reports a CVSS 4.0 score of 5.4 with MEDIUM severity, vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P. The published ZDI list instead indicates CVSS 7.8. Both numbers appear in primary sources, but the reason for the divergence is not documented in the sources.

The official vector qualifies the attack as local (AV:L), with user interaction required (UI:P), limited impact on confidentiality and integrity (VC:L, VI:L) but high availability impact (VA:H). This technical profile is consistent with a scenario where opening a file causes execution in the context of the process, without documented privilege escalation.

The Fix: What Changes in the Parser

The CVE Record describes the implemented mitigation: "in fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed." The fix acts on two fronts: sanitization of bounds checking to prevent the overflow, and explicit interruption of cyclic recursion in page references.

Neither the ZDI advisory nor the CVE Record specify the exact versions that incorporate the fix. Users must verify the update through official LibreOffice channels or their Linux distribution.

What to Do Now

For environments using LibreOffice for document management or legacy databases:

• Check for updates via your distribution's package manager or the official LibreOffice update channel
• Restrict opening .odb files from untrusted sources, since the vector requires user interaction

Source Limitations and Methodological Notes

ZDI sources 1 and 2 are identical mirrors with no additional data. ZDI source 4 (published list) is a summary table without additional technical details. The CVE Record (source 3) provides the complete technical detail and the official CVSS 4.0.

Frequently Asked Questions

Why do the CVSS scores differ?
The CVE Record reports CVSS 4.0 score 5.4; the ZDI list indicates 7.8. The reason for the divergence is not documented in the sources. Both values are present in primary sources without official explanation of the gap.

Is the vulnerability zero-click?
No. The ZDI advisory explicitly states that user interaction is required: opening a malicious file or visiting a compromised page.

Is the dBase format still relevant?
The dBase format and its derivatives like .odb remain in use in legacy environments and document management systems. The persistence of these formats makes the vulnerability relevant for organizations that cannot easily migrate.

Who developed the patch?
Caolán McNamara of Collabora Productivity, a principal contributor to LibreOffice development.

Are there public exploits?
No primary source documents in-the-wild exploits or public proof-of-concept code at the time of the advisory's publication.

Sources

• zerodayinitiative.com
• zerodayinitiative.com
• cve.org
• zerodayinitiative.com