LibreOffice CVE-2026-76181: update past 26.2.5, and plan the 26.2 EOL

If LibreOffice is how you open Word and Excel files at home, check the version today. On November 5, 2026, The Document Foundation published CVE-2026-76181 on its security advisories page: a heap buffer overflow in the dBASE index import path. Fixed builds are LibreOffice 26.2.6 and 26.8.1 (or newer).

Two days earlier, on November 3, 2026, TDF also shipped LibreOffice 26.2.7, the last maintenance release of the 26.2 line (TDF blog). That branch reaches end of life on November 30, 2026. So this is both a security update and a short calendar reminder.

What the advisory says

LibreOffice’s security advisories page for CVE-2026-76181 describes the bug this way, in plain terms:

• LibreOffice can open a folder of dBASE tables as a data source, including their .ndx index files.
• When it read an index page, it trusted the page’s entry count without checking how many entries that page could hold. A bad index could also point a page back at itself, so the reader looped forever and overflowed memory.
• Fixed builds cap those counts and refuse to follow a page that loops back to a parent page.
• Upgrade to LibreOffice 26.2.6 or newer, or 26.8.1 or newer.

Credits on the advisory: Claude (Anthropic’s agent work studying open-source security) found the issue, Ada Logics validated and reported it, an anonymous researcher working with TrendAI Zero Day Initiative also reported it, and Caolán McNamara of Collabora Productivity wrote the fix.

You do not need to run dBASE files every day for this to matter. Document apps parse formats you did not expect. Treat a published overflow in a data-source importer as “update the office suite,” the same way you treat a browser patch.

How this lines up with 26.2.7

LibreOffice 26.2.7 is the seventh maintenance update on the 26.2 branch. TDF calls out everyday fixes (macOS 27 startup crash, Windows presentation audio, DOCX round-trips, bundled Python 3.12.16, Calc Web Query .iqy support) and says 26.2.7 is the last 26.2 release. End of life is 30 November 2026. TDF tells people who install 26.2.7 to plan a move to LibreOffice 26.8 by the end of November, following the announcement of LibreOffice 26.8.3.

Security math for home installs:

• If Help > About shows anything older than 26.2.6 on the 26.2 line, you are missing the CVE-2026-76181 fix. Install 26.2.7, or jump to the current 26.8 download (today that is 26.8.2, which is above the advisory floor).
• 26.8.0 is still below the floor. The advisory requires 26.8.1 or newer on that branch.
• If you are already on 26.2.6 or 26.2.7, you have the dBASE fix on that branch. Still plan the move to 26.8 before November 30, when 26.2 stops getting further fixes.
• If you already run 26.8.1 or newer, confirm About shows at least that floor for this CVE. Prefer 26.8.2 on a fresh install: TDF’s October 29 post made 26.8.2 the current 26.8 release and notes earlier 26.8 builds may crash on startup on macOS 27.

Download only from libreoffice.org/download, not from random “office suite” mirrors. TDF also says LibreOffice 26.2 requires Windows 10 or newer.

How to update and verify on your computer

1. Open LibreOffice on the PC or Mac you actually use for documents.
2. Help > About LibreOffice (on macOS, LibreOffice > About LibreOffice). Read the version string.
3. If you are below 26.2.6 (or on 26.8.0 / below 26.8.1 on the 26.8 line): download the current installer from LibreOffice’s download page (currently 26.8.2 on the 26.8 line), run it, and finish the install. On Windows, 26.2 needs Windows 10 or newer.
4. Fully quit LibreOffice (every Writer, Calc, Impress window), then open it again.
5. Check About again. Aim for 26.2.7 if you are staying on 26.2 for another week or two, or 26.8.2 (or at least 26.8.1) if you are ready to move branches now.
6. Repeat on other home computers that still have an old LibreOffice install, including a rarely used laptop that only opens school worksheets.

Linux users who install LibreOffice from their distribution should update through that package manager and still confirm the version string. Flatpak or Snap installs update through those tools. The goal is still a build that meets the advisory floors above.

Do this / don’t do that

Do

• Read Help > About yourself. Do not trust a months-old desktop shortcut memory.
• Prefer official TDF downloads when the in-distro package lags.
• Put a calendar reminder before November 30, 2026 if you install 26.2.7 and still need to move to 26.8.

Don’t

• Do not leave 26.2.5 or older installed because “LibreOffice updates themselves somehow.”
• Do not open unexpected .dbf / .ndx data folders from email while you are still unpatched.
• Do not install cracked “LibreOffice Pro” packs from third-party sites.

Bottom line

On November 5, 2026, LibreOffice announced CVE-2026-76181, a dBASE index heap overflow fixed in 26.2.6 and 26.8.1 (security advisories). On November 3, TDF also released 26.2.7, the last 26.2 build before that branch’s November 30 end of life (TDF blog). On your own computer: update, relaunch, confirm Help > About, then plan the short hop to 26.8 if you are still on 26.2.

Image: Official LibreOffice 26.2 release art from blog.documentfoundation.org.