Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

LibreOffice/core

              master @ d572576
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Out-of-bounds Read: 3 prior fixes. Scrutinize any change in this area.

sc: most-fixed (2 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Legacy active content features like Java Applets and plug-in filters provide a direct path for executing untrusted payload code inside the document layout engine, leading to full sandbox escape or arbitrary execution. Legacy support was removed to block this vector.

Auth Bypass: Evaluating macro execution privileges based on the transient frame model instead of the containing document model allows attackers to bypass security boundaries, letting untrusted macros run silently.

Out-of-bounds Read: Downcasting objects (such as FormulaToken) without type verification permits attackers to craft spreadsheet documents that trigger type confusion, leading to out-of-bounds heap memory access and potential arbitrary code execution.