CVE-2026-76181: LibreOffice dBase Heap Buffer Overflow — Detection and Remediation Guide

---
title: LibreOffice Spawning Suspicious Child Process
description: Detects soffice.exe/soffice.bin spawning shells, script interpreters, or LOLBins — consistent with post-exploitation after a document parser exploit such as CVE-2026-76181.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-895/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
id: 3f9c1a72-4b6e-4d58-9a21-7c2e5f8b0d43
status: experimental
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\soffice.bin'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare macro-driven workflows launching scripts; review per host baseline
level: high
---
title: dBase File Downloaded via Browser or Email Client
description: Detects creation of .dbf files in user download or temp locations, a delivery vector for CVE-2026-76181 exploitation.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-895/
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
id: 8b2d4e61-1f7a-4c39-b5e2-9d0a6c3f7e15
status: experimental
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection_name:
    TargetFilename|endswith: '.dbf'
  selection_path:
    TargetFilename|contains:
      - '\Downloads\'
      - '\Temp\'
      - '\AppData\Local\Temp\'
      - 'INetCache'
      - 'Content.Outlook'
  condition: selection_name and selection_path
falsepositives:
  - GIS, logistics, or legacy database workflows legitimately exchanging .dbf files; whitelist known source applications
level: medium
---
title: LibreOffice Process Crash Followed by Child Execution
description: Detects WerFault or crash-handler activity for soffice.bin closely associated with suspicious process launches — heap corruption during parse attempts often precedes or accompanies process instability.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-895/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
id: c5e7a290-3d81-4f46-a62b-1e8f4d9c2b67
status: experimental
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_crash:
    Image|endswith:
      - '\WerFault.exe'
      - '\wermgr.exe'
    CommandLine|contains: 'soffice'
  condition: selection_crash
falsepositives:
  - Genuine LibreOffice instability; correlate with child-process rule hits on the same host
level: medium

// Hunt: LibreOffice spawning suspicious child processes (CVE-2026-76181 exploitation pattern)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "soffice.bin" or InitiatingProcessFileName =~ "soffice.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","curl.exe","certutil.exe","bitsadmin.exe","wmic.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc
;
// Companion hunt: .dbf files delivered via browser or email within the same window
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName endswith ".dbf"
| where FolderPath has_any ("Downloads","Temp","INetCache","Content.Outlook")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256
| order by TimeGenerated desc

-- Hunt for LibreOffice child-process anomalies and dropped .dbf artifacts (CVE-2026-76181)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist(parent='soffice.bin')
WHERE Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|curl|certutil|bitsadmin|wmic)'

-- Enumerate recently created .dbf files in user-writable delivery locations
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['C:/Users/*/Downloads/*.dbf',
                 'C:/Users/*/AppData/Local/Temp/*.dbf',
                 'C:/Users/*/AppData/Local/Microsoft/Windows/INetCache/**/*.dbf'])
WHERE Mtime > now() - 1209600

# CVE-2026-76181 — LibreOffice inventory and version verification
# Detect installed LibreOffice versions via registry uninstall keys
$paths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$installs = Get-ItemProperty $paths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -like 'LibreOffice*' } |
    Select-Object DisplayName, DisplayVersion, InstallLocation

if (-not $installs) {
    Write-Output 'CLEAN: No LibreOffice installation detected on this host.'
    exit 0
}

foreach ($i in $installs) {
    Write-Output ("FOUND: {0} | Version: {1} | Path: {2}" -f $i.DisplayName, $i.DisplayVersion, $i.InstallLocation)
    # ACTION REQUIRED: verify DisplayVersion against the fixed build listed in the
    # Document Foundation security advisory for CVE-2026-76181 and upgrade if older.
}

# Optional hardening: block .dbf attachments at the edge is preferred; as a local
# control, confirm Attack Surface Reduction rules are active (requires Defender):
$asr = Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids -ErrorAction SilentlyContinue
if ($asr -notcontains 'D4F940AB-401B-4EFC-AADC-AD5F3C50688A') {
    Write-Output 'WARNING: ASR rule "Block all Office applications from creating child processes" is NOT enabled.'
    # Enable it (audit first in production to gauge macro impact):
    # Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
}