Gnome Gnumeric vulnerabilities

4 CVEs affecting Gnome Gnumeric, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97222, published 2026-09-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-0668, published 2008-02-11. High severity, CVSS 9.3. EPSS: 5% chance of exploitation in the next 30 days. The excel_read_HLINK function in plugins/excel/ms-excel-read.c in Gnome Office Gnumeric before 1.8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file containing…
CVE-2013-6836, published 2013-12-19. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a…
CVE-2009-0318, published 2009-01-28. Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days. Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory,…
CVE-2026-97222, published 2026-09-25. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed…