ANT-2026-G7GNYY68 · libreoffice

heap-buffer-overflow medium

CVE-2026-6045

Severity Claude high · Security research firm high · Maintainer medium

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-G7GNYY68: Heap Buffer Overflow via Integer Overflow in EMF+ Brush Blend Point Parsing

An integer overflow during parsing of EMF+ brush blend points leads to a heap buffer overflow.

Target

Project: libreoffice
Location: drawinglayer/source/tools/emfpbrush.cxx:EMFPBrush::Read
Discovery: static analysis — not yet dynamically reproduced

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. A trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-G7GNYY68.

Reference: ANT-2026-G7GNYY68
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict
true positive
Severity
high
TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-29 Reported to tracker
  2. 2026-04-09 Sent to maintainer
  3. 2026-04-29 Patch released
  4. 2026-05-09 Maintainer acknowledged
  5. 2026-08-17 Publicly revealed
PROVENANCE

SHA-3-512 hash:

d3fd15b9dba2859842eca0b54091853a125bd20ca023ce3b82e5a4d1cccd8c92384c803858f19b22b61c66823161cb21ee42fe234e93b24e86b1efb9faab8469

Committed 2026-04-09 11:50 PT

Revealed 2026-08-17 14:12 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-G7GNYY68",
  "bug_class": "Heap Buffer Overflow",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:12+00:00",
  "description": "An integer overflow during parsing of EMF+ brush blend points leads to a heap buffer overflow.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "LibreOffice",
  "reproduction": null,
  "technical_details": null,
  "title": "Heap Buffer Overflow via Integer Overflow in EMF+ Brush Blend Point Parsing",
  "vendor_severity": "high"
}