CVE-2026-63269 in LibreOffice
Summary
by MITRE • 10/05/2026
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified involves a flaw in how LibreOffice handles external resource references within documents on Linux systems, specifically concerning audio and video files managed through GStreamer. When a user opens or loads a document containing links to multimedia assets, the application relies on the underlying media framework to resolve these resources. In vulnerable versions of the software, if a linked file is identified as an HLS playlist rather than a direct media stream, LibreOffice inadvertently instructs GStreamer to parse and follow this playlist structure during the initial loading phase. This behavior allows for the automatic resolution of all resource URLs listed within that playlist without explicit user interaction or confirmation at each step.
This mechanism creates a significant security risk because it enables unauthorized network access and potential data exfiltration. As GStreamer processes the HLS playlist, it attempts to fetch every media segment or URL specified therein. If these URLs point to local file paths on the victim's machine, sensitive content from those locations can be read by the application. Furthermore, if the URLs are remote endpoints controlled by an attacker, the system may transmit data back to external servers during document loading. The contents of these accessed files could potentially be embedded or cached within the document structure itself, leading to unintended disclosure of private information stored on the local filesystem.
From a technical classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-918 Server-Side Request Forgery (SSRF). The application fails to adequately validate whether linked resources are direct media files or complex playlist structures that contain further references. By automatically resolving nested URLs within playlists during the document load process, LibreOffice effectively acts as a proxy for arbitrary resource fetching, bypassing standard security controls that would normally require user consent for network requests. This behavior is also relevant to ATT&CK technique T1078 Valid Accounts or T1560 Archive Collected Data if local files are accessed, and T1041 Exfiltration Over C2 Channel if remote URLs are targeted, as the data transfer occurs during a seemingly benign document opening action.
The operational impact of this vulnerability is severe due to its potential for silent exploitation. An attacker could craft a malicious LibreOffice document containing an HLS playlist that references sensitive local files or exfiltration endpoints. Upon simply opening such a document in a vulnerable version, the system would automatically process these links without prompting the user. This bypasses typical security warnings associated with macro execution or external content loading, making it difficult for users to detect the malicious activity. The automatic nature of the resource fetching means that even cautious users who avoid enabling macros are still at risk if they open a document containing such a playlist link.
To mitigate this vulnerability, LibreOffice has implemented changes in its fixed versions to restrict how linked media is processed during document loading. Specifically, the application no longer follows playlists that name further resources automatically. Instead, it treats these complex structures as static references rather than executable instructions for resource fetching. Additionally, all linked media content is now placed under strict link update control. This means that when a document containing external links is opened, LibreOffice will not automatically resolve or fetch the associated files unless explicitly instructed by the user through manual interaction with the link management features. Users are advised to ensure their LibreOffice installation is updated to the latest stable version where these safeguards are active. Administrators should also enforce policies that disable automatic content loading for external resources and encourage users to review linked objects before allowing them to be resolved, thereby minimizing the attack surface associated with document-based resource fetching mechanisms.