CVE-2026-63272

MediumCVSS 5.4/10Last modified Sep 22, 2026

Description

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.

Metrics

CVSS 4.0 5.4/10CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-125CWE-787

Affected software

VendorProductVersions
The Document FoundationLibreOffice>= 26.2, < < 26.2.5

References

Timeline

Published
Sep 22, 2026
Last modified
Sep 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-632735.4LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryptionCVE-2026-632745.4LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was takenCVE-2026-632755.4LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The nCVE-2026-632765.4LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embeCVE-2026-632778.5LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java databCVE-2026-632786.7URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated CVE-2026-632795.4LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a coCVE-2026-63288.3Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocCVE-2026-632808.8Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions adminCVE-2026-632814.8Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/CVE-2026-632826.5Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege eCVE-2026-632867.1Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS