CVE-2013-6836: Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office...

Security readout for executives and security teams

CVE-2013-6836 is a crash bug in Gnumeric's Excel file parser. A specially crafted XLS file can trigger a heap buffer overflow and crash the application. Sources describe denial of service, not data theft or code execution. Exposure is most likely on systems where GNOME Office Gnumeric before 1.12.9 opens or imports XLS files, especially files received from external parties. The supplied affected-product metadata is incomplete, so confirm installed package versions directly. Treat this as a targeted availability risk for users or workflows relying on Gnumeric to process XLS files. Prioritize patching where external spreadsheet files are routinely opened. Business urgency is lower than remote code execution issues based on supplied evidence. Mitigation focus: Upgrade Gnumeric to version 1.12.9 or later.; Apply fixed distribution packages, including relevant openSUSE advisory packages.; Avoid opening untrusted XLS files with vulnerable Gnumeric versions..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.