Heap buffer overflow in PDF import stream handling
Priority LOW 24CWE-125Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Partial Red Hat: 4 fixed, 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Partial LibreOffice (The Document Foundation): < 26.2.5Red Hat: 2 advisoriesRed Hat: 4 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Document Foundation | LibreOffice | 26.2 to before < 26.2.5 | < 26.2.5 | Patch available | CNA |
- LibreOffice VendorThe Document Foundation Affected 26.2 to before < 26.2.5 Fixed in < 26.2.5 Patch available CNA
Remediation
- Fix · CNA LibreOffice (The Document Foundation) Fixed in < 26.2.5
Red Hat 2 advisories
- RHSA-2026:88164 Released 2026-10-22 · Red Hat rating Importantflute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) autocorr-af-1:7.1.8.1-3.el8_10, autocorr-bg-1:7.1.8.1-3.el8_10, autocorr-ca-1:7.1.8.1-3.el8_10 +47
- Red Hat Enterprise Linux CRB (v. 8) libreoffice-sdk-1:7.1.8.1-3.el8_10, libreoffice-sdk-doc-1:7.1.8.1-3.el8_10
- RHSA-2026:82013 Released 2026-10-13 · Red Hat rating Importantlibreoffice security update
- Red Hat Enterprise Linux AppStream (v. 9) autocorr-af-1:7.1.8.1-15.el9_8.3, autocorr-bg-1:7.1.8.1-15.el9_8.3, autocorr-ca-1:7.1.8.1-15.el9_8.3 +47
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libreoffice-sdk-1:7.1.8.1-15.el9_8.3, libreoffice-sdk-doc-1:7.1.8.1-15.el9_8.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
The Document Foundation LibreOffice < 26.2.5
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2026-45134 Package URLs can be used to exfiltrate arbitrary INI file values and environment variablesPriority LOW 29
- TI-2026-45133 Stack buffer overflow in CFF to Type 1 font conversionPriority LOW 24
- TI-2026-45132 Stack buffer overflow in CFF font hint handlingPriority LOW 24
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:88164 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:82013 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2026:88164 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2026:82013 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63274
- 2026-10-03 Alias added: GHSA-q9rh-47xp-mj2m
- 2026-10-13 Fix available: RHSA-2026:82013 · Red Hat
- 2026-10-13 Fix available: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88164 · Red Hat
- 2026-10-23 Fix available: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · Red Hat
More The Document Foundation vulnerabilities
- TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
- TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
- TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
- TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
- TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
- TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-63274 · CVE Program
- CVE-2026-63274 · NVD
- FIRST EPSS
- GHSA-q9rh-47xp-mj2m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-63274 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences