Public bug reported:
After the SRU update of LibreOffice to 4:24.2.7-0ubuntu0.24.04.5 (installed on
2026-05-29 from noble-updates/noble-security), LibreOffice crashes immediately
when opening ANY ZIP-container document: .ods, .xlsx, .docx, .odt, etc.
Legacy binary formats (.doc, .xls) open correctly.
The crash also happens in headless mode (no GUI), so it is unrelated to
the graphical stack / Skia / OpenGL.
glibc aborts the process with:
corrupted size vs. prev_size
i.e. heap memory corruption inside the document import path.
This is reproducible on MULTIPLE machines that received the same update,
so it is a regression in the package, not local corruption.
--------------------------------------------------------------------------
STEPS TO REPRODUCE:
1. On Ubuntu 24.04 with libreoffice 4:24.2.7-0ubuntu0.24.04.5 installed.
2. Create a fresh spreadsheet from a CSV (so the file cannot be "corrupt"):
printf 'a,b\n1,2\n' > /tmp/x.csv
soffice -env:UserInstallation=file:///tmp/p1 --headless \
--convert-to ods --outdir /tmp/new /tmp/x.csv # writes OK
3. Re-open (read) that brand-new .ods:
soffice -env:UserInstallation=file:///tmp/p2 --headless \
--convert-to pdf --outdir /tmp/new /tmp/new/x.ods
EXPECTED: a PDF is produced.
ACTUAL: process aborts with "corrupted size vs. prev_size" (exit/hang).
--------------------------------------------------------------------------
DIAGNOSIS (already narrowed down by elimination):
- A clean user profile (-env:UserInstallation=...) does NOT help -> not the
profile.
- A document created on the spot by LibreOffice itself also crashes -> not the
file.
- liblzma5 (updated 2026-06-03 to 5.6.1+really5.4.5-1ubuntu0.3) was RULED OUT:
LD_PRELOAD of the base 5.6.1+really5.4.5-1 still crashes.
- zlib1g, libxml2, libexpat1, libicu74, freetype, harfbuzz, cairo, glib, libc6:
no updates in the last 2 weeks (checked /var/log/dpkg.log) -> ruled out.
- dpkg --audit is clean, no half-configured packages, no disk/RAM errors.
- The ONLY component in the ZIP read path updated recently (2026-05-29) and
present on all affected machines is libreoffice-core rev. ...04.5.
Only ZIP-based filters (package/sax import) are affected; the binary .doc/.xls
import filter works fine -> the regression is in the shared ODF/OOXML import
path.
--------------------------------------------------------------------------
WORKAROUND:
Downgrade LibreOffice to the original Noble release 4:24.2.2-0ubuntu1 and hold
it.
After the downgrade all ZIP-based documents open normally, which confirms the
regression is in revision ...04.5.
--------------------------------------------------------------------------
ENVIRONMENT:
- Ubuntu 24.04.4 LTS (Noble Numbat)
- Kernel 6.17.0-35-generic
- libreoffice-core 4:24.2.7-0ubuntu0.24.04.5
- Regression introduced by the SRU dated 2026-05-29 (rev. ...04.4 -> ...04.5)
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: libreoffice (not installed)
ProcVersionSignature: Ubuntu 6.17.0-35.35~24.04.1-generic 6.17.13
Uname: Linux 6.17.0-35-generic x86_64
ApportVersion: 2.28.1-0ubuntu3.8
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Wed Jun 10 11:32:47 2026
InstallationDate: Installed on 2024-10-24 (594 days ago)
InstallationMedia: Ubuntu 24.04.1 LTS "Noble Numbat" - Release amd64
(20240827.1)
ProcEnviron:
LANG=it_IT.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
SourcePackage: libreoffice
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: libreoffice (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2156339
Title:
LibreOffice 24.2.7-0ubuntu0.24.04.5 crashes (heap corruption) when
opening any ZIP-based document (ODF/OOXML)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/2156339/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
