Skip to content
OpenAdvisories
High ALSA-2026:88164 4 CVEs

Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

Published Oct 22, 2026 · Updated Oct 29, 2026

Summary

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages.

Security Fix(es):

* libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274)
* libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276)
* libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275)
* libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277)

Bug Fix(es) and Enhancement(s):

* [libbase] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275415)
* [flute] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275416)
* [libserializer] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275417)
* [libloader] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275418)
* [libformula] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275419)
* [librepository] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275420)
* [libfonts] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275421)
* [liblayout] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275422)
* [pentaho-libxml] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275423)
* [pentaho-reporting-flow-engine] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275424)
* [sac] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-277813)
* [libreoffice] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-260518)
* [AlmaLinux 8.10] Base Report Wizard fails with packaged Pentaho reporting engine (JIRA:AlmaLinux-286491)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 184

ReleasePackageFixed in
AlmaLinux · 8 autocorr-af 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-bg 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-ca 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-cs 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-da 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-de 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-el 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-en 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-es 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-fa 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-fi 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-fr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-ga 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-hr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-hu 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-is 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-it 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-ja 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-ko 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-lb 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-lt 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-mn 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-nl 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-pl 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-pt 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-ro 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-ru 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-sk 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-sl 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-sr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-sv 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-tr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-vi 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 autocorr-zh 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 flute 1.3.0-19.OOo31.el8_10
AlmaLinux · 8 libbase 1.1.3-21.el8_10
AlmaLinux · 8 libfonts 1.1.3-23.el8_10
AlmaLinux · 8 libformula 1.1.3-20.el8_10
AlmaLinux · 8 liblayout 0.2.10-19.el8_10
AlmaLinux · 8 libloader 1.1.3-19.el8_10
AlmaLinux · 8 libreoffice 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-base 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-calc 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-core 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-data 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-draw 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-emailmerge 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-filters 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-gdb-debug-support 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-graphicfilter 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-gtk3 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-ar 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-bg 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-bn 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-ca 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-cs 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-da 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-de 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-dz 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-el 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-en 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-es 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-et 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-eu 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-fi 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-fr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-gl 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-gu 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-he 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-hi 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-hr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-hu 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-id 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-it 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-ja 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-ko 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-lt 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-lv 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-nb 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-nl 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-nn 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-pl 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-pt-BR 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-pt-PT 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-ro 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-ru 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-si 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-sk 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-sl 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-sv 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-ta 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-tr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-uk 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-zh-Hans 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-help-zh-Hant 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-impress 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-af 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ar 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-as 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-bg 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-bn 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-br 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ca 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-cs 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-cy 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-da 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-de 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-dz 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-el 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-en 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-es 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-et 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-eu 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-fa 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-fi 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-fr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ga 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-gl 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-gu 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-he 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-hi 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-hr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-hu 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-id 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-it 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ja 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-kk 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-kn 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ko 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-lt 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-lv 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-mai 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ml 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-mr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-nb 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-nl 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-nn 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-nr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-nso 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-or 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-pa 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-pl 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-pt-BR 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-pt-PT 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ro 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ru 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-si 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-sk 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-sl 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-sr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ss 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-st 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-sv 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ta 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-te 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-th 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-tn 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-tr 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ts 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-uk 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-ve 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-xh 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-zh-Hans 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-zh-Hant 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-langpack-zu 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-math 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-ogltrans 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-opensymbol-fonts 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-pdfimport 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-pyuno 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-sdk 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-sdk-doc 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-ure 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-ure-common 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-wiki-publisher 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-writer 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-x11 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreoffice-xsltfilter 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 libreofficekit 1:7.1.8.1-3.el8_10.alma.1
AlmaLinux · 8 librepository 1.1.3-19.el8_10
AlmaLinux · 8 libserializer 1.1.2-20.el8_10
AlmaLinux · 8 pentaho-libxml 1.1.3-20.el8_10
AlmaLinux · 8 pentaho-reporting-flow-engine 1:0.9.4-17.el8_10
AlmaLinux · 8 sac 1.3-29.el8_10

Vulnerabilities 4

  • High 8.5
    CVE-2026-63277 Public exploit

    RCE via calcext:data-mappings, sql provider and jdbc connector

    LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that l…

  • Medium 5.4

    Heap buffer overflow in PDF import stream handling

    LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stre…

  • Medium 5.4

    Stack buffer overflow in CFF font hint handling

    LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past …

  • Medium 5.4

    Stack buffer overflow in CFF to Type 1 font conversion

    LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixe…

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-63274
  • report
    https://access.redhat.com/security/cve/CVE-2026-63275
  • report
    https://access.redhat.com/security/cve/CVE-2026-63276
  • report
    https://access.redhat.com/security/cve/CVE-2026-63277
  • report
    https://bugzilla.redhat.com/2537936
  • report
    https://bugzilla.redhat.com/2538242
  • report
    https://bugzilla.redhat.com/2538363
  • report
    https://bugzilla.redhat.com/2545885
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-88164.html