- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 10
- Public CVEs
- 72
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
10 assets you may test, 6 excluded.
Web 1
- https://www.libreoffice.org
Products and areas 9
- Digital-signature validation for both document and macro signatures.
- Formula parsing and compilation in Calc (for example the CVE-2026-8357 heap overflow during formula compilation) and formula/OLE handling in Writer and Math.
- Graphics and embedded-object import filters parsed on document load, including EMF/EMF+, WMF, DXF, and SVG.
- Legacy binary import filters, DOC, XLS, and PPT (MS Office 97-2003) plus RTF, handled through the writerfilter, oox, and filter modules.
- Multiple concurrently maintained release lines receive fixes, including the fresh and still (LTS-style) branches such as 26.2.x and 25.8.x.
- ODF import and parsing for ODT, ODS, and ODP, including the OpenDocument encryption and signature stack.
- OOXML import filters for DOCX, XLSX, and PPTX, covering document and text-box parsing, deferred parser-event replay, and encryption-header handling, the suite's richest historical bug surface (for example the CVE-2026-6047 type-confusion in OOXML text-box import and the CVE-2026-4430 out-of-bounds write from an OOXML encryption salt mismatch).
- The macro and scripting subsystem: Basic macros, document-embedded scripting, and the surrounding security controls (macro security levels, auto-execution, and event bindings).
- URL and hyperlink handling together with password and encryption management for protected documents.
Out of scope (6)
- Antivirus false positives or heuristic detections against LibreOffice binaries or installers.
- Defects in bundled third-party libraries that should be attributed upstream, unless LibreOffice's own use of them is the flaw.
- Documented, intended behavior of macros and scripting when the user explicitly enables or runs them.
- End-of-life release branches that no longer receive security fixes.
- Non-security functional bugs, which belong in the public Bugzilla rather than the security contact.
- Reports that require the attacker to already hold local code execution or control of the user's configuration.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Submit a clear proof of concept, including the crafted document, the affected version, and the platform when the bug is platform-dependent.
-
Test only against your own installations and files; never target other users or third-party infrastructure.
-
Report each distinct vulnerability separately with enough detail to reproduce it reliably.
-
Do not run automated fuzzing or scanning against any project-hosted service; fuzz locally and submit only triaged, exploitable results.
-
Keep findings confidential until sorona.xyz and the project confirm a fix or agree on disclosure.
Not accepted
-
Documented, intended behavior of macros and scripting when the user explicitly enables or runs them.
-
Non-security functional bugs
-
End-of-life release branches that no longer receive security fixes.
-
Defects in bundled third-party libraries that should be attributed upstream
-
Reports that require the attacker to already hold local code execution or control of the user's configuration.
-
Antivirus false positives or heuristic detections against LibreOffice binaries or installers.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-4430 | Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7. | Medium 5.4 | 7 May 2026 |
| CVE-2025-14714 | An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges In fixed versions parent-constraints are used to allow only the ma | Low 0.9 | 15 Dec 2025 |
| CVE-2025-2866 | Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2. | Low 2.4 | 27 Apr 2025 |
| CVE-2021-25635 | An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a valid signature issued by a trusted person This issue | Medium 5.2 | 21 Mar 2025 |
| CVE-2025-1080 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary argume | High 7.2 | 4 Mar 2025 |
| CVE-2025-0514 | Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.This issue affects LibreOffice: from 24.8 before < 24.8.5. | High 7.2 | 25 Feb 2025 |
| CVE-2024-12426 | Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. This issue affects LibreOffice: from 24.8 before | Medium 6.7 | 7 Jan 2025 |
| CVE-2024-12425 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4. | Low 2.4 | 7 Jan 2025 |
| CVE-2024-7788 | Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before < 24.2.5. | High 7.8 | 17 Sep 2024 |
| CVE-2024-6472 | Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document with a signed macro is opened a warning is displayed by LibreOffice before the macro is executed. Previously if verification failed the user could fail to understand the failure and choose to | High 7.8 | 5 Aug 2024 |
| CVE-2024-5261 | Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents. LibreOffice internally makes use of "curl" to fetch remot | Critical 10.0 | 25 Jun 2024 |
| CVE-2024-3044 | Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted. | Medium 6.5 | 14 May 2024 |
| CVE-2023-6186 | Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected versions LibreOffice supports hyperlinks with macro or similar built-in command targets that can be executed when activated without warning the user. | High 8.3 | 11 Dec 2023 |
| CVE-2023-6185 | Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system. | High 8.3 | 11 Dec 2023 |
| CVE-2023-1183 | A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker. | Medium 5.0 | 10 Jul 2023 |
| CVE-2023-0950 | Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it | High 7.8 | 25 May 2023 |
| CVE-2023-2255 | Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsiste | Medium 5.3 | 25 May 2023 |
| CVE-2022-3140 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice links using that scheme could be constructed to call internal macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in | Medium 6.3 | 11 Oct 2022 |
| CVE-2022-26305 | An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate. An adversary could therefore create an arbitrary certifi | High 7.5 | 25 Jul 2022 |
| CVE-2022-26306 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's | High 7.5 | 25 Jul 2022 |
| CVE-2022-26307 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to th | High 8.8 | 25 Jul 2022 |
| CVE-2021-25636 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xm | High 7.5 | 24 Feb 2022 |
| CVE-2021-25634 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice | High 7.5 | 12 Oct 2021 |
| CVE-2021-25633 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xm | High 7.5 | 11 Oct 2021 |
| CVE-2021-25631 | In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an executable type. | High 8.8 | 3 May 2021 |
| CVE-2018-18688 | The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, an Incremental Saving vulnerability exists in multiple products. When an attacker uses the Incremental Saving feature to add pages or annotations, Body Updates are displayed to the user without any action by the signature-validation logic. | Medium 5.3 | 7 Jan 2021 |
| CVE-2020-12802 | LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote graphic links loaded from docx documents were omitted from this protection prior to versi | Medium 5.3 | 8 Jun 2020 |
| CVE-2020-12803 | ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need for macros or other active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to | Medium 6.5 | 8 Jun 2020 |
| CVE-2020-12801 | If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the file format of the recovered document was not LibreOffice's default ODF file format, then affected versions of LibreOffice default that subsequent saves of the d | Medium 5.3 | 18 May 2020 |
| CVE-2012-5639 | LibreOffice and OpenOffice automatically open embedded content | Medium 6.5 | 20 Dec 2019 |
| CVE-2019-9853 | LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in the possibility to construct a document where macro execution bypassed the security settings. The docu | High 7.8 | 27 Sep 2019 |
| CVE-2019-9854 | LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2019-9852, to avoid a directory traversal attack where scrip | High 7.8 | 6 Sep 2019 |
| CVE-2019-9855 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added to block calling LibreLogo fro | Critical 9.8 | 6 Sep 2019 |
| CVE-2019-9850 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to | Critical 9.8 | 15 Aug 2019 |
| CVE-2019-9851 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre | Critical 9.8 | 15 Aug 2019 |
| CVE-2019-9852 | LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scri | High 7.8 | 15 Aug 2019 |
| CVE-2019-9848 | LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained | Critical 9.8 | 17 Jul 2019 |
| CVE-2019-9849 | LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5. This issue affects: Do | Medium 4.3 | 17 Jul 2019 |
| CVE-2019-9847 | A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. If the hyperlink is activated by the victim the executable target is unconditionally launched. Under Windows and macOS when processing a hyperlink target explicitly activated by the user there was no judgment | High 7.8 | 9 May 2019 |
| CVE-2018-16858 | It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location. | High 7.8 | 25 Mar 2019 |
| CVE-2018-14939 | The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact if LibreOffice is automatically launched during web browsing with pathnames controlled by a remot | Critical 9.8 | 5 Aug 2018 |
| CVE-2018-10583 | An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. | High 7.5 | 1 May 2018 |
| CVE-2018-10120 | The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record. | High 7.8 | 16 Apr 2018 |
| CVE-2018-10119 | sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format. | High 7.8 | 16 Apr 2018 |
| CVE-2018-6871 | LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function. | Critical 9.8 | 9 Feb 2018 |
| CVE-2017-14226 | WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application. | High 7.5 | 9 Sep 2017 |
| CVE-2017-8358 | LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx. | Critical 9.8 | 30 Apr 2017 |
| CVE-2017-7882 | LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx. | Critical 9.8 | 15 Apr 2017 |
| CVE-2017-7870 | LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx. | Critical 9.8 | 14 Apr 2017 |
| CVE-2016-10327 | LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx. | Critical 9.8 | 14 Apr 2017 |
| CVE-2017-7856 | LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function in vcl/source/gdi/svmconverter.cxx. | Critical 9.8 | 14 Apr 2017 |
| CVE-2016-4324 | Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens. | High 7.8 | 8 Jul 2016 |
| CVE-2016-0795 | LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document. | High 7.8 | 18 Feb 2016 |
| CVE-2016-0794 | The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document. | High 7.8 | 18 Feb 2016 |
| CVE-2015-5214 | LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via an index to a non-existent bookmark in a DOC file. | Medium 6.8 | 10 Nov 2015 |
| CVE-2015-5213 | Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a long DOC file, which triggers a buffer overflow. | Medium 6.8 | 10 Nov 2015 |
| CVE-2015-5212 | Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via crafted PrinterSetup data in an ODF document. | Medium 6.8 | 10 Nov 2015 |
| CVE-2015-4551 | LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow remote attackers to obtain sensitive information via a crafted document, which embeds data from local files into (1) Calc or (2) Writer. | Medium 4.3 | 10 Nov 2015 |
| CVE-2015-1774 | The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write. | Medium 6.8 | 28 Apr 2015 |
| CVE-2014-9093 | LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file. | High 7.5 | 26 Nov 2014 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : $100 - $5,000 Google Patch Rewards pays this project as a Tier 2 target (it qualifies through its OSS-Fuzz integration), for a patch you land upstream and that stays merged, without reverts, for one month. It is paid for the patch, not for the report, and it is rate-limited to three submissions a month. Sanctions and territory exclusions apply. CVE history 7 Last 12 months 72 Lifetime Memory safety 28 % Code execution 24 % Parsing/validation 20 % Access control 15 % Latest advisories Loading the feed Overview LibreOffice is the widely used open-source office suite whose Writer, Calc, Impress and Draw applications parse a broad range of document formats, including OOXML, ODF and numerous legacy binary formats, making its import filters a large and historically vulnerable attack surface. The Document Foundation runs a vulnerability disclosure program through a shared security list and issues coordinated advisories, but pays no bounty of its own. Report through sorona.xyz and we pay you directly on qualified, reproduced findings, with up to 2x the base payout for hard, chained bugs. In scope OOXML import filters for DOCX, XLSX, and PPTX, covering document and text-box parsing, deferred parser-event replay, and encryption-header handling, the suite's richest historical bug surface (for example the CVE-2026-6047 type-confusion in OOXML text-box import and the CVE-2026-4430 out-of-bounds write from an OOXML encryption salt mismatch). ODF import and parsing for ODT, ODS, and ODP, including the OpenDocument encryption and signature stack. Legacy binary import filters, DOC, XLS, and PPT (MS Office 97-2003) plus RTF, handled through the writerfilter, oox, and filter modules. Graphics and embedded-object import filters parsed on document load, including EMF/EMF+, WMF, DXF, and SVG. Formula parsing and compilation in Calc (for example the CVE-2026-8357 heap overflow during formula compilation) and formula/OLE handling in Writer and Math. The macro and scripting subsystem: Basic macros, document-embedded scripting, and the surrounding security controls (macro security levels, auto-execution, and event bindings). Digital-signature validation for both document and macro signatures. URL and hyperlink handling together with password and encryption management for protected documents. Multiple concurrently maintained release lines receive fixes, including the fresh and still (LTS-style) branches such as 26.2.x and 25.8.x. Out of scope Documented, intended behavior of macros and scripting when the user explicitly enables or runs them. Non-security functional bugs, which belong in the public Bugzilla rather than the security contact. End-of-life release branches that no longer receive security fixes. Defects in bundled third-party libraries that should be attributed upstream, unless LibreOffice's own use of them is the flaw. Reports that require the attacker to already hold local code execution or control of the user's configuration. Antivirus false positives or heuristic detections against LibreOffice binaries or installers. Most-valued findings Memory-safety bugs in file-format import filters, heap and stack buffer overflow, out-of-bounds read and write, and use-after-free, triggered by opening a crafted document. Type confusion during parsing, where an object is written through the wrong type's field layout. Integer overflow that leads to undersized allocation or out-of-bounds access. Arbitrary code execution via crafted documents through formula compilation or filter parsing. Macro and scripting security-control bypass, including auto-exec, event-driven launch, and signed-macro trust bypass. Digital-signature validation bypass or spoofing (CWE-347) that makes a tampered document appear trusted. Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Submit a clear proof of concept, including the crafted document, the affected version, and the platform when the bug is platform-dependent. Test only against your own installations and files; never target other users or third-party infrastructure. Report each distinct vulnerability separately with enough detail to reproduce it reliably. Do not run automated fuzzing or scanning against any project-hosted service; fuzz locally and submit only triaged, exploitable results. Keep findings confidential until sorona.xyz and the project confirm a fix or agree on disclosure. Payout follows sorona.xyz's confirmation of a reproduced, qualified finding; chained or hard-to-exploit bugs may earn up to 2x the base. Disclosure The project's policy is coordinated disclosure, with public advisories typically issued within 30 days of a fix being available. Reporters are credited in advisories unless they ask to remain anonymous. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability