Two heap-buffer-overflow vulnerabilities in LibreOffice were revealed on 2026-07-08, and LibreOffice enters the Mythos dashboard for the first time. All of the day’s identifiers fall within the “Other” ecosystem, with the aggregate totals standing at 2136 disclosed, 1730 acknowledged, 419 patched, and 456 CVEs/GHSAs published.
LibreOffice (new project)
CVE-2026-8357 and CVE-2026-8358 are both heap-buffer-overflow bugs in LibreOffice. These two CVEs are the project’s opening entries on the Mythos dashboard.
Both identifiers share the same bug class and the same project, making 2026-07-08 a focused day rather than a scattered one. LibreOffice’s debut signals that Mythos is reaching into broadly deployed desktop software, and the consistency of the bug class across both findings suggests a localized code path worth close attention. The aggregate picture — 2136 disclosed, 1730 acknowledged, 419 patched, 456 CVEs/GHSAs published — is the backdrop against which both identifiers land.
Source: Anthropic Mythos dashboard at https://red.anthropic.com/2026/cvd/
Backfilled: reconstructed from the revealed_at timestamps in Anthropic’s CVD payload (as of 2026-08-26T18:55:53.809770Z), not published live on 2026-07-08.