CVE-2026-63276
Received Received - Intake

LibreOffice CFF Font Conversion Stack Buffer Overflow

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Document Foundation, The

Description
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-63276
EUVD
EUVD-2026-84356

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the_document_foundation libreoffice *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LibreOffice has a vulnerability where it converts CFF fonts to Type 1 during PDF export. This conversion uses a fixed-size buffer without checking if the data fits, allowing a stack buffer overflow if a glyph emits too many operators.

Detection Guidance

This vulnerability is specific to LibreOffice's font conversion process during PDF export. Detection requires checking for vulnerable LibreOffice versions and analyzing PDF export logs for crashes or errors during font subsetting. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or crash LibreOffice by exploiting the buffer overflow during PDF export of documents containing specially crafted CFF fonts.

Compliance Impact

The vulnerability involves a stack buffer overflow during CFF to Type 1 font conversion in LibreOffice, which could lead to arbitrary code execution. This may impact compliance by potentially exposing sensitive document data, violating confidentiality requirements under GDPR and HIPAA if exploited.

Mitigation Strategies

Update LibreOffice to the latest fixed version to prevent the stack buffer overflow during CFF to Type 1 font conversion. Avoid opening untrusted documents or PDFs until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart