CVE-2026-63276

MediumCVSS 5.4/10Last modified Sep 22, 2026

Description

LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.

Metrics

CVSS 4.0 5.4/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2026
Last modified: Sep 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-632778.5LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java datab CVE-2026-632786.7URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated CVE-2026-632795.4LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a co CVE-2026-63288.3Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protoc CVE-2026-632808.8Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions admin CVE-2026-632814.8Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/CVE-2026-632826.5Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege e CVE-2026-632867.1Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS CVE-2026-632876.5It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could b CVE-2026-632888.3A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authen CVE-2026-63296.5PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched M CVE-2026-632927.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a rem