CVE-2026-63275

MediumCVSS 5.4/10Last modified Sep 22, 2026

Description

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.

Metrics

CVSS 4.0 5.4/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2026
Last modified: Sep 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-632765.4LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embe CVE-2026-632778.5LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java datab CVE-2026-632786.7URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated CVE-2026-632795.4LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a co CVE-2026-63288.3Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protoc CVE-2026-632808.8Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions admin CVE-2026-632814.8Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/CVE-2026-63296.5PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched M CVE-2026-632927.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a rem CVE-2026-632939.9A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When import CVE-2026-632949.9A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpackin CVE-2026-632954.3An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When