Summary
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.
Security Fix(es):
* libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274)
* libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276)
* libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275)
* libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | libreoffice | 1:7.1.8.1-15.el9_8.3 |
Vulnerabilities 4
-
High 8.5CVE-2026-63277 Public exploit
RCE via calcext:data-mappings, sql provider and jdbc connector
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that l…
-
Medium 5.4
Heap buffer overflow in PDF import stream handling
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stre…
-
Medium 5.4
Stack buffer overflow in CFF font hint handling
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past …
-
Medium 5.4
Stack buffer overflow in CFF to Type 1 font conversion
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixe…