CVE-2016-10327

What it actually does

Heap-based buffer overflow in EnhWMFReader::ReadEnhWMF leading to out-of-bounds write during Enhanced Metafile (WMF/EMF) parsing, enabling memory corruption and potential arbitrary code execution.

Why it matters to the business

Attackers can achieve remote code execution on systems processing untrusted documents, resulting in full system compromise, data exfiltration, or ransomware deployment without user interaction beyond opening a file.

How an attack unfolds

An attacker crafts a malicious Enhanced Metafile image containing oversized or malformed records that trigger the buffer overflow in the WMF reader; the victim opens the document or preview in an affected LibreOffice version, causing the overflow to overwrite heap memory and execute attacker-controlled code.

How to fix it

Upgrade LibreOffice to a build containing commit 7485fc2a1484f31631f62f97e5c64c0ae74c6416 or later release after 2016-12-22; for packaged nri-jmx components ensure version 0 or equivalent patched distribution is deployed.

How to confirm the fix worked

Verify installed LibreOffice version is newer than the vulnerable cutoff or contains the referenced commit; test with known-good and known-malicious WMF samples in a sandbox to confirm absence of crash or memory corruption.

Typical attack path

1. Craft malicious WMF/EMF image exploiting ReadEnhWMF bounds check failure
2. Embed image in document or deliver standalone file via email, web, or shared storage
3. Victim opens file or triggers preview in LibreOffice
4. Overflow corrupts heap structures leading to code execution
5. Attacker payload establishes persistence or exfiltrates data

How to detect it

Review application crash logs for WMF/EMF parsing faults, inspect document metadata for unusual EMF/WMF objects, and search endpoint telemetry for unexpected child processes spawned from LibreOffice when handling image files.

What your security team should do

• Immediately inventory all LibreOffice installations and prioritize upgrade to fixed versions
• Block or sandbox processing of untrusted WMF/EMF images until patched
• Monitor vulnerability disclosure lists for any newly published exploits given the 9.8 CVSS score
• Implement file-type filtering at mail gateways and file shares for EMF/WMF content