CVE-2026-63279
Received Received - Intake

Out-of-Bounds Read in LibreOffice PICT Image Import

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Document Foundation, The

Description
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-63279
EUVD
EUVD-2026-84358

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the_document_foundation libreoffice *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LibreOffice has a vulnerability where it can incorrectly handle PICT images with color palettes. When importing such images, the software reads a palette index from the image data but fails to verify if the index is within the valid range of the palette. This leads to an out of bounds read, potentially accessing memory outside the palette.

Detection Guidance

This vulnerability involves an out of bounds read when importing PICT images with invalid palette indices in LibreOffice. Detection requires checking for vulnerable LibreOffice versions and inspecting documents for embedded PICT images with malformed palette data. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory contents by tricking a user into opening a specially crafted document. This might lead to information disclosure or further exploitation depending on the system configuration.

Compliance Impact

This vulnerability could potentially lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR or HIPAA if personal or health information is exposed. Organizations must ensure systems are patched to avoid such risks.

Mitigation Strategies

Update LibreOffice to a fixed version where palette indices are validated. Avoid opening untrusted documents, especially those containing PICT images. If immediate updates are not possible, disable LibreOffice's ability to import PICT images as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63279. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart