Skip to content
OpenAdvisories
High USN-8868-1 8 CVEs

libreoffice vulnerabilities

Published Oct 5, 2026 · Updated Oct 5, 2026

Ecosystem: Ubuntu

Summary

It was discovered that LibreOffice incorrectly handled WMF image
imports. An attacker could possibly use this issue to cause LibreOffice
to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2026-63272)

It was discovered that LibreOffice incorrectly handled PDF document
imports. An attacker could possibly use this issue to cause LibreOffice
to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2026-63273, CVE-2026-63274)

It was discovered that LibreOffice incorrectly handled CFF fonts
embedded in documents. An attacker could possibly use this issue to
cause LibreOffice to crash, resulting in a denial of service, or
execute arbitrary code. (CVE-2026-63275, CVE-2026-63276)

It was discovered that LibreOffice incorrectly validated package URLs.
An attacker could possibly use this issue to obtain sensitive
information. (CVE-2026-63278)

It was discovered that LibreOffice incorrectly handled PICT image
imports. An attacker could possibly use this issue to cause LibreOffice
to crash, resulting in a denial of service, or obtain sensitive
information. (CVE-2026-63279)

It was discovered that LibreOffice incorrectly mitigated out-of-bounds
writes via Graphite font actions. An attacker could possibly use this
issue to cause LibreOffice to crash, resulting in a denial of service,
or execute arbitrary code. (CVE-2026-50593)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS libreoffice 1:7.3.7-0ubuntu0.22.04.13
Ubuntu · 24.04 LTS 24.04:LTS libreoffice 4:24.2.7-0ubuntu0.24.04.7
Ubuntu · 26.04 LTS 26.04:LTS libreoffice 4:26.2.6.3-0ubuntu0.26.04.2

Vulnerabilities 8

  • High 7.3
    CVE-2026-50593

    Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat …

    Graphite Graphite graphite2 graphite2 Debian Ubuntu Azure Linux
  • Medium 6.7
    CVE-2026-63278

    Package URLs can be used to exfiltrate arbitrary INI file values and environment variables

    URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise ev…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63272

    Heap buffer overflow in WMF text record import

    LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately fro…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63273

    Heap buffer overflow in PDF import encryption handling

    LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63274

    Heap buffer overflow in PDF import stream handling

    LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stre…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63275

    Stack buffer overflow in CFF font hint handling

    LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past …

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63276

    Stack buffer overflow in CFF to Type 1 font conversion

    LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixe…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63279

    Out of bounds read in PICT image import

    LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-50593
  • report
    https://ubuntu.com/security/CVE-2026-63272
  • report
    https://ubuntu.com/security/CVE-2026-63273
  • report
    https://ubuntu.com/security/CVE-2026-63274
  • report
    https://ubuntu.com/security/CVE-2026-63275
  • report
    https://ubuntu.com/security/CVE-2026-63276
  • report
    https://ubuntu.com/security/CVE-2026-63278
  • report
    https://ubuntu.com/security/CVE-2026-63279