CVE-2026-63275
Received Received - Intake

LibreOffice Stack Buffer Overflow in CFF Font Parsing

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Document Foundation, The

Description
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-63275
EUVD
EUVD-2026-84355

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the_document_foundation libreoffice *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LibreOffice has a stack buffer overflow vulnerability when processing CFF fonts embedded in documents. The issue occurs when reading glyph hints, where the number of hints exceeds the array's capacity, causing a write past the array's end. Fixed versions now properly check the hint count against the array's actual capacity.

Detection Guidance

This vulnerability is specific to LibreOffice's handling of CFF fonts and requires checking for vulnerable versions of LibreOffice. No direct network or system detection commands are provided in the context. Ensure LibreOffice is updated to a patched version to address the issue.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by tricking a user into opening a maliciously crafted document. It primarily affects users who process files containing CFF fonts in LibreOffice.

Compliance Impact

This vulnerability involves a stack buffer overflow in LibreOffice when processing CFF fonts, which could lead to arbitrary code execution. Such vulnerabilities may impact compliance by potentially exposing sensitive data if exploited, though direct effects on GDPR or HIPAA depend on specific usage contexts and mitigations.

Mitigation Strategies

Update LibreOffice to the latest fixed version to prevent the stack buffer overflow when reading CFF font hints. Avoid opening untrusted documents, especially those containing embedded fonts, until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63275. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart