CVE-2023-0950

What it actually does

Improper array index validation in the spreadsheet formula interpreter allows an underflow when malformed formulas such as AGGREGATE are supplied with fewer parameters than expected, creating the possibility of arbitrary code execution.

Why it matters to the business

Successful exploitation can result in full compromise of user workstations that open attacker-supplied documents, enabling data theft, ransomware deployment, or lateral movement with no user privileges required beyond opening the file.

How an attack unfolds

An attacker creates a spreadsheet containing a specially crafted AGGREGATE formula that passes fewer arguments than the interpreter expects. When the victim opens the document in an affected LibreOffice version, the resulting array index underflow is leveraged to corrupt memory and execute attacker-supplied code.

How to fix it

Upgrade LibreOffice 7.4 installations to 7.4.6 or newer and 7.5 installations to 7.5.1 or newer. Apply the corresponding fixed packages listed for each distribution once available.

How to confirm the fix worked

Confirm LibreOffice version is at or above 7.4.6 / 7.5.1; attempt to open a test document containing an AGGREGATE formula with deliberately omitted parameters and verify the application does not crash or execute unexpected code.

Typical attack path

1. Craft malicious spreadsheet with under-parameterized formula
2. Distribute document via email, download link, or shared storage
3. Victim opens file in vulnerable LibreOffice release
4. Formula interpreter triggers array index underflow
5. Arbitrary code execution occurs within the LibreOffice process

How to detect it

Review file-open logs, process creation events, and any crash reports or memory dumps from LibreOffice instances; look for unexpected child processes or network connections immediately after spreadsheet files are opened.

What your security team should do

• Immediately update all LibreOffice instances to the fixed releases
• Block or sandbox inbound spreadsheet files from untrusted sources until patches are deployed
• Add the published fixed package versions to enterprise update automation
• Monitor EPSS and KEV status for any future increase in observed exploitation