CVE-2013-6836: Gnome Gnumeric

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.

Affected products

• Gnome Gnumeric: up to and including 1.12.8; version 1.12.0 only; version 1.12.1 only; version 1.12.2 only; version 1.12.3 only; version 1.12.4 only; …

Published 2013-12-19. Last modified 2026-06-17.