CVE-2026-63269
Received Received - Intake

LibreOffice HLS Playlist Media Linking Vulnerability

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: Document Foundation, The

Description
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-63269
EUVD
EUVD-2026-92420

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
The Document Foundation LibreOffice 26.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LibreOffice has a vulnerability where it can link to audio or video files in a document. On Linux systems, these files are played using GStreamer. An attacker could craft a malicious HLS playlist file that tricks GStreamer into reading local files or remote URLs listed in the playlist. The contents of these files could then be embedded into the document.

Detection Guidance

Detecting this vulnerability involves checking for LibreOffice documents that link to external media files, particularly HLS playlists. Inspect documents for embedded links to audio or video files and verify if they reference remote URLs or local files. Use tools like 'strings' or 'grep' to search for suspicious URLs in documents. Monitor network traffic for unexpected connections to media servers when opening documents.

Impact Analysis

This vulnerability could allow an attacker to access sensitive files on your system if you open a maliciously crafted LibreOffice document. It may also expose internal network resources if the document links to remote URLs controlled by the attacker.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) if personal or health-related files are exposed. Organizations must ensure systems are patched to maintain compliance.

Mitigation Strategies

Update LibreOffice to the latest fixed version to prevent following HLS playlists that reference further resources. Disable automatic media playback in LibreOffice settings. Avoid opening documents from untrusted sources. Review and remove any linked media files in existing documents. Monitor for unusual file access patterns on your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart