"Office Party" flaw in Anthropic Claude DOCX/PPTX/XLSX skills (soffice.py LD_PRELOAD shim) enables code execution on Linux

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5577 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Office Party - lo_socket_shim.so Planted by Non-Linker Process (Exploitation)

Detects creation or modification of /tmp/lo_socket_shim.so by any process other than the GNU linker. The Anthropic docx/xlsx/pptx skills soffice.py helper reuses this fixed-path library through LD_PRELOAD with no ownership or content check, so a copy written by anything but the linker (collect2/ld during the skill's own gcc build) is the core exploit primitive of the Office Party flaw (TL-2026-5577, CWE-427/CWE-377). The planted library masquerades as the legitimate skill-built shim (T1036.005) by reusing its expected name and location, so name-based allowlists alone are insufficient; compare writer, owner and hash.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574.006, T1195.002, T1036.005
• Data sources: sysmon_for_linux, linux_file_events, defender_for_endpoint_linux
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=11 TargetFilename="*/lo_socket_shim.so" earliest=-24h
| where NOT (like(Image,"%/ld") OR like(Image,"%/ld.bfd") OR like(Image,"%/ld.gold") OR like(Image,"%/ld.lld") OR like(Image,"%/collect2") OR like(Image,"%-linux-gnu-ld%"))
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as writer_processes values(User) as users by host, TargetFilename
| convert ctime(first_seen) ctime(last_seen)
| table host TargetFilename writer_processes users count first_seen last_seen

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName =~ "lo_socket_shim.so"
| where not(InitiatingProcessFileName in~ ("ld", "ld.bfd", "ld.gold", "ld.lld", "collect2", "x86_64-linux-gnu-ld", "x86_64-linux-gnu-ld.bfd"))
| project Timestamp, DeviceName, ActionType, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName

Sigma

title: Planted lo_socket_shim.so Written by Non-Linker Process
id: 5b1e7c3a-2f4d-4a8e-9c61-0d3f7a9b1e01
status: experimental
description: Detects creation of lo_socket_shim.so by a process other than the GNU linker. The Anthropic Office skills soffice.py helper loads this fixed-path library via LD_PRELOAD without ownership or content checks (Office Party, TL-2026-5577).
references:
    - https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/
    - https://github.com/anthropics/skills/blob/main/skills/docx/scripts/office/soffice.py
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.persistence
    - attack.privilege_escalation
    - attack.defense_evasion
    - attack.t1574.006
    - attack.t1036.005
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '/lo_socket_shim.so'
    filter_linker:
        Image|endswith:
            - '/ld'
            - '/ld.bfd'
            - '/ld.gold'
            - '/ld.lld'
            - '/collect2'
    condition: selection and not filter_linker
falsepositives:
    - Administrators or CI jobs that pre-build and copy a trusted shim into the temp directory
    - Package or container image build steps that install a vetted shim
level: high

Known false positives:

• Administrators or CI jobs that pre-build and copy a trusted lo_socket_shim.so into the temp directory
• Container image build steps that install a vetted shim using cp, install or rsync

Tuning notes: Adjust index/sourcetype to your Sysmon for Linux ingestion. Add the image path of any approved build tooling to the writer exclusion list. Compare the SHA256 of hits against a trusted build of the shim; alert at critical if the writer is a download tool or interpreter (curl, wget, bash, python). Because the file deliberately reuses the trusted name, also compare its owner against the user that runs the skill (soffice.py performs no ownership check).

• 🔒 Office Party - LD_PRELOAD Pointing at Temp Path for soffice (Exploitation) · unlock with TL Creds
• 🔒 Office Party - Lingering or Foreign lo_socket_shim.c Source File (Post-Exploitation / Tampered Build) · unlock with TL Creds
• 🔒 Office Party - Outbound Public Connection from Headless LibreOffice (C2 / Callback) · unlock with TL Creds
• 🔒 Office Party - Modification of Claude Office Skill [indicator] (Supply Chain / Exploitation) · unlock with TL Creds
• 🔒 Office Party - soffice Launched by Python with lo_profile (Skill Execution Trigger) · unlock with TL Creds
• 🔒 Office Party - Remote Access or Download Tools Spawned by LibreOffice (Lateral Movement / Tool Transfer) · unlock with TL Creds
• 🔒 Office Party - Shim Compiled with gcc by Skill Helper (Post-Exploitation / Compile After Delivery) · unlock with TL Creds
• 🔒 Office Party - LibreOffice soffice Spawning Shells or Interpreters (Post-Injection Execution) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5577.

Technical analysis

Dark Reading reports the flaw as unresolved; no CVE has been assigned.

Anthropic's official Office skills (docx, xlsx, pptx) each ship a helper script, soffice.py, that runs LibreOffice (soffice) headless to convert documents, for example rendering DOCX to PDF. The script describes itself as a helper for running LibreOffice in environments where AF_UNIX sockets may be blocked (e.g. sandboxed VMs).

Mechanism (from the upstream source and Trail of Bits): _needs_shim() tries to create an AF_UNIX socket and treats an OSError as a sign that the shim is needed. If so, _ensure_shim() uses the fixed path <tempdir>/lo_socket_shim.so. If that file already exists it is reused with no ownership or content check. Otherwise the script writes embedded C source to <tempdir>/lo_socket_shim.c, compiles it with 'gcc -shared -fPIC -ldl', and deletes the source. get_soffice_env() then sets LD_PRELOAD to the shim for the soffice child process. The shim intercepts socket(), listen(), accept() and close() and emulates AF_UNIX with socketpair().

AIR Security (via Dark Reading) dubbed this "Office Party". An attacker who can create a file in the temporary directory that Claude can access, for example a malicious lo_socket_shim.so, gets arbitrary native code executed inside the soffice process the next time a document is generated or converted. AIR demonstrated this by manually placing a malicious library in the temp directory before asking Claude Code to generate a document. Affected setups are Linux environments where Unix sockets are blocked, including some container security configurations and Claude Code's sandbox. AIR reports macOS is not affected because it does not use LD_PRELOAD. Dark Reading reports the flaw remains unresolved. AIR recommends treating AI skills as software dependencies rather than trusted extensions.

Trail of Bits independently described the same pattern on 2026-06-03, noting that a malicious /tmp/lo_socket_shim.so planted in a claude.ai or other sandbox would be patched in and executed without scrutiny of the compiled contents. It also noted that Cisco's skill-scanner rated the finding LOW (LLM analyzer) and MEDIUM (pattern rule). Third-party skill audits of copies of the skill flag the fixed path and the gcc compile step as high or medium risk. Their verdicts conflict, and some say the shim is purpose-aligned.

Limits of this record: the Dark Reading article body could not be retrieved (HTTP 403), so publication date, vendor response and exact scope come from search-result summaries. No CVE, CVSS score, in-the-wild exploitation or network IOCs were found. Severity is an analyst estimate. Exploitation needs a write primitive to the temp directory plus a trigger that makes Claude run the skill.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.004 Compile After Delivery; T1574.006 Dynamic Linker Hijacking

Execution

T1059.006 Python; T1204.002 Malicious File

Initial Access

T1195.002 Compromise Software Supply Chain

stealth

T1574.006 Dynamic Linker Hijacking

Remediation

Patches

• No vendor fix confirmed at time of research; Dark Reading reports the flaw as unresolved. Check the anthropics/skills repository for changes to soffice.py

Immediate actions

• Do not run the Anthropic docx/xlsx/pptx skills in Linux sandboxes where AF_UNIX sockets are blocked until the script is patched or reviewed
• Check for pre-existing /tmp/lo_socket_shim.so and lo_socket_shim.c on hosts and containers where Claude skills run, and delete any file not built by a trusted run
• Restrict write access to the temp directory the agent uses, or give the agent a private per-session TMPDIR

Workarounds

• Patch soffice.py locally to use a private mode-0700 directory instead of the fixed /tmp path, and verify ownership and hash of the shim before loading
• Pre-build and ship a trusted shim read-only, or use an environment where AF_UNIX sockets are permitted so the shim is not needed

Longer-term hardening

• Treat AI skills as software dependencies: pin versions, review scripts, and control who can add or update them
• Do not rely on automated skill scanners alone to judge skill safety
• Mount temp directories noexec where feasible and monitor LD_PRELOAD use by agent-spawned processes

Affected and fixed versions

• Anthropic — Claude Office skills (docx, xlsx, pptx) soffice.py helper
  Vulnerable versions: Versions that include the soffice.py LD_PRELOAD shim logic; exact version range not published
• Anthropic — Claude Code (sandbox on Linux where Unix sockets are blocked)
  Vulnerable versions: Linux configurations with blocked AF_UNIX sockets; versions not specified

Timeline

• 2026-06-03 Trail of Bits post links the trailofbits/overtly-malicious-skills proof-of-concept repository alongside its skill-scanner bypass research, including the note on locked-ioc-6's LD_PRELOAD behavior.
• 2026-06-03 Trail of Bits notes Cisco's skill-scanner rated the locked-ioc-6 behavior LOW (LLM analyzer) and MEDIUM (pattern rule), showing scanners struggle to separate it from legitimate behavior.
• 2026-06-03 Trail of Bits publishes 'The sorry state of skill distribution', describing locked-ioc-6's LD_PRELOAD shim and the planted locked-ioc-2 risk in Anthropic's Office skills.
• 2026-06-04 tl;dr sec issue #331 summarizes the Trail of Bits post, noting that the official docx, xlsx and pptx skills ship locked-ioc-6, which loads a pre-existing locked-ioc-4 from a temp directory or compiles one at runtime. No vendor response is mentioned.
• 2026-06-25 Cloud Security Alliance publishes guidance on Claude agent skills risks for CISOs, covering the skills supply-chain context.
• 2026-11-09 Threadlinqs research found no Anthropic advisory, CVE or confirmed fix for the locked-ioc-6 shim behavior; the upstream script still showed the fixed locked-ioc-2 path and gcc build logic when fetched.
• 2026-11-09 Threadlinqs hunt observed Dark Reading's coverage of AIR Security's 'Office Party' research (article publication date unverified: page returned HTTP 403). Per the article, the flaw remains unresolved.

Sources cited

• The sorry state of skill distribution (Trail of Bits) blog.trailofbits.com · Research · 2026-06-03
• A Journey into Claude's Sandbox (Bishop Fox) bishopfox.com · Research
• Skill Issues: Compromising Claude Code with Malicious Skills & Agents, Part 1 (Reversec) labs.reversec.com · Research
• How Claude Code escapes its own denylist and sandbox (Ona) ona.com · Research
• anthropics/skills docx soffice.py (upstream source) GitHub · Code repository
• trailofbits/overtly-malicious-skills (proof-of-concept repository) GitHub · Proof of concept · 2026-06-03
• 5 Claude Agent Skills Risks Every CISO Should Know (Cloud Security Alliance) cloudsecurityalliance.org · Blog · 2026-06-25
• Skills, Connectors, Plugins, Oh My: A Security Practitioner's Map of the Claude Extension Ecosystem (Pluto Security) pluto.security · Blog
• Claude Flaw Threatens Linux Orgs with Malicious Code Execution (Dark Reading) Dark Reading · News
• tl;dr sec #331 (summary of Trail of Bits skill-distribution research) tldrsec.com · News · 2026-06-04

More in vulnerability

• ForgeRock Attack Chain: Default admin:admin Felix Console Credentials and WAF Path-Encoding Bypass Lead to RCE and Remote Vehicle Unlock at Two Automakers
• WidzialniCMS < 2.5 unauthenticated file upload RCE (CVE-2026-110468, CVE-2026-110469) plus reflected XSS (CVE-2026-112204) and login lockout bypass (CVE-2026-112205)
• ModSecurity WAF Vulnerabilities: Multipart filename* Upload Bypass (CVE-2026-104269) and XML Body Processor Uninitialized Pointer Dereference (CVE-2026-73857)
• Web3Auth Infrastructure Flaw Exploited to Drain Keplr Wallets Created via Google/Apple Sign-in (Private Key Breach)
• ModSecurity v3 RFC 2231 filename* Multipart Parser Differential Bypasses WAF Filename Rules (CVE-2026-104269)

Further reading

• Anthropic AI Misuse Report (Sept 2026) Mapped