CVE-2018-14939: Libreoffice

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact if LibreOffice is automatically launched during web browsing with pathnames controlled by a remote web site.

Affected products

• Libreoffice Libreoffice: up to and including 6.0.5

Published 2018-08-05. Last modified 2026-06-17.