CVE Feed

    Dashboard / CVE / CVE-2026-63276

    CVE-2026-63276

    LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.

    Published:Sep 22, 2026
    Last Modified:Sep 22, 2026
    EPS:Sep 22, 2026
    EPSS Score:
    CVSS Score:5.4

    Affected Products

    Vendor
    The Document Foundation
    Product
    Libreoffice

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-787 Out-of-bounds Write

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-63270 (CVSS 6.7) — URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive inf…
    CVE-2026-63269 (CVSS 6.7) — LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A li…
    CVE-2026-63267 (CVSS 6.7) — LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. …
    CVE-2026-63268 (CVSS 6.7) — LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A li…
    CVE-2026-63266 (CVSS 6.8) — LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Thro…
    CVE-2026-63277 (CVSS 8.5) — LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A do…
    CVE-2026-63279 (CVSS 5.4) — LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when imp…
    CVE-2026-63278 (CVSS 6.7) — URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive inf…
    CVE-2026-63275 (CVSS 5.4) — LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when readi…
    CVE-2026-63274 (CVSS 5.4) — LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High