Submit finding

All findings

CVE-2026-8357 high

Anthropic's CVD ledger names Sonnet 4.6 on a LibreOffice vulnerability

Project Glasswing card ANT-2026-XV1EVAMH explicitly attributes the fixed LibreOffice CVE-2026-8357 finding to Claude Sonnet 4.6.

Bug class
Document-import memory-safety vulnerability
Affected codebase
LibreOffice
Credited system
Claude Sonnet 4.6
Disclosed
July 8, 2026
Attribution
Direct source attribution
AI role
Discovery
Severity
high
Source status: Anthropic's public finding card explicitly names Claude Sonnet 4.6 and records a fixed, patched, vendor-confirmed LibreOffice report mapped to CVE-2026-8357.

Summary

This qualifying Project Glasswing row explicitly names Claude Sonnet 4.6. It is kept separate from the Mythos and Opus subsets so the system profile receives only the CVE actually attributed to it.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.