libreoffice-26.2.4.2

[Bruce Dubbs]

New point version.

[martyj19]

Poppler adjustments all upstream.

[Joe Locash]

Now at 26.2.4.1.

[martyj19]

26.2.4.1 is a release candidate. Normally the release would progress to 26.2.4.2 and then be announced on libreoffice.org. The .0 releases usually progress to .0.3 with an extra release candidate.

https://wiki.documentfoundation.org/ReleasePlan/26.2

There have been times when a .1 release is announced as a critical hotfix but you can always tell by looking at the Release Plan page.

[Douglas R. Reno]

There should be a new version tomorrow.

In the meantime, I must report a security issue:

CVE-2026-4430 Heap Buffer Overflow in AgileEngine

Announced: May 06, 2026

Fixed in: LibreOffice 26.2.3 and LibreOffice 25.8.7

Description:

Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted 
OOXML documents with mismatched encryption salt parameters.

This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.

Credits:

Thanks to Duc Anh Nguyen (@Danzation) for finding and reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

References:

CVE-2026-4430

This is rated as Medium, so to Elevated it goes

[martyj19]

Adjustment for poppler 26.06

[martyj19]

26.2.4 now uploaded and announced. Poppler 26.06 adjustment required.

[Douglas R. Reno]

I'm going to reassign these to the book for now so whoever wants to do them can do them.

In the meantime I will continue working on rivendell, but I do not want to continue holding the project back on important issues.

[pierre]

Updated at 4a736de66c. Leaving open for SA

[Douglas R. Reno]

SA-13.0-129 issued