Skip to content
OpenAdvisories
Medium WID-SEC-2026-3521 7 CVEs

LibreOffice: Mehrere Schwachstellen

Published Sep 22, 2026 · Updated Nov 11, 2026 · Revision 8 · de

Vendor: amazon Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux Product: Linux 2 Product: Rocky Linux Platform: Windows

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in LibreOffice ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten zu manipulieren oder Informationen offenzulegen.

Product

LibreOffice ist eine leistungsfähige Office-Suite, voll kompatibel mit den Programmen anderer großer Office-Anbieter, für verbreitete Betriebssysteme wie Windows, GNU/Linux und Apple Mac OS X geeignet. LibreOffice bietet sechs Anwendungen für die Erstellung von Dokumenten und zur Datenverarbeitung: Writer, Calc, Impress, Draw, Base und Math.

Vulnerabilities 7

  • Medium 6.7
    CVE-2026-63278

    Package URLs can be used to exfiltrate arbitrary INI file values and environment variables

    URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise ev…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63272

    Heap buffer overflow in WMF text record import

    LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately fro…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63273

    Heap buffer overflow in PDF import encryption handling

    LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63274

    Heap buffer overflow in PDF import stream handling

    LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stre…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63275

    Stack buffer overflow in CFF font hint handling

    LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past …

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63276

    Stack buffer overflow in CFF to Type 1 font conversion

    LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixe…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2026-63279

    Out of bounds read in PICT image import

    LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu

Revision history

  1. #8

    Neue Updates von Red Hat aufgenommen

  2. #7

    Neue Updates von Oracle Linux aufgenommen

  3. #6

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  4. #5

    Neue Updates von Red Hat aufgenommen

  5. #4

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  6. #3

    Neue Updates von Amazon aufgenommen

  7. #2

    Neue Updates von Ubuntu aufgenommen

  8. #1

    Initiale Fassung

References