Stack buffer overflow in CFF font hint handling
Priority LOW 24CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Partial Red Hat: 4 fixed, 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00187 8th percentileScored 2026-11-07
Fix Partial LibreOffice (The Document Foundation): < 26.2.5Red Hat: 2 advisoriesRed Hat: 4 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Document Foundation | LibreOffice | 26.2 to before < 26.2.5 | < 26.2.5 | Patch available | CNA |
- LibreOffice VendorThe Document Foundation Affected 26.2 to before < 26.2.5 Fixed in < 26.2.5 Patch available CNA
Remediation
- Fix · CNA LibreOffice (The Document Foundation) Fixed in < 26.2.5
Red Hat 2 advisories
- RHSA-2026:88164 Released 2026-10-22 · Red Hat rating Importantflute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) autocorr-af-1:7.1.8.1-3.el8_10, autocorr-bg-1:7.1.8.1-3.el8_10, autocorr-ca-1:7.1.8.1-3.el8_10 +47
- Red Hat Enterprise Linux CRB (v. 8) libreoffice-sdk-1:7.1.8.1-3.el8_10, libreoffice-sdk-doc-1:7.1.8.1-3.el8_10
- RHSA-2026:82013 Released 2026-10-13 · Red Hat rating Importantlibreoffice security update
- Red Hat Enterprise Linux AppStream (v. 9) autocorr-af-1:7.1.8.1-15.el9_8.3, autocorr-bg-1:7.1.8.1-15.el9_8.3, autocorr-ca-1:7.1.8.1-15.el9_8.3 +47
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libreoffice-sdk-1:7.1.8.1-15.el9_8.3, libreoffice-sdk-doc-1:7.1.8.1-15.el9_8.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
The Document Foundation LibreOffice < 26.2.5
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2026-45134 Package URLs can be used to exfiltrate arbitrary INI file values and environment variablesPriority LOW 29
- TI-2026-45133 Stack buffer overflow in CFF to Type 1 font conversionPriority LOW 24
- TI-2026-45131 Heap buffer overflow in PDF import stream handlingPriority LOW 24
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:88164 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:82013 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2026:88164 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2026:82013 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63275
- 2026-10-03 Alias added: GHSA-fh9h-5g6m-wc43
- 2026-10-13 Fix available: RHSA-2026:82013 · Red Hat
- 2026-10-13 Fix available: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88164 · Red Hat
- 2026-10-23 Fix available: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · Red Hat
More The Document Foundation vulnerabilities
- TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
- TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
- TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
- TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
- TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
- TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-63275 · CVE Program
- CVE-2026-63275 · NVD
- FIRST EPSS
- GHSA-fh9h-5g6m-wc43 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-63275 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences