CVE-2026-63272
Received Received - Intake

Heap Buffer Overflow in LibreOffice WMF Import

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Document Foundation, The

Description
LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-63272
EUVD
EUVD-2026-84352

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the_document_foundation libreoffice *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LibreOffice has a vulnerability where it can incorrectly handle WMF graphics embedded in documents. Specifically, a heap buffer overflow occurs when importing a text record with its own character advance widths. The issue arises when the count of advance values and the text length do not match, causing the program to access memory outside the intended array bounds.

Detection Guidance

This vulnerability involves a heap buffer overflow when importing WMF graphics in LibreOffice. Detection requires checking for vulnerable LibreOffice versions and inspecting documents for embedded WMF files with malformed text records. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by tricking a user into opening a specially crafted document. Since it involves heap buffer overflow, it may lead to crashes or unexpected behavior in LibreOffice.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical flaw in LibreOffice's WMF graphics import functionality. However, if exploited, it could lead to arbitrary code execution, potentially compromising systems handling sensitive data under these regulations.

Mitigation Strategies

Update LibreOffice to a fixed version where an advance array shorter than its text is ignored during WMF graphic import.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart