CVE-2026-63272 in LibreOffice
Summary
by MITRE • 09/22/2026
LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in LibreOffice involves a critical heap buffer overflow within the component responsible for importing Windows Metafile (WMF) graphics embedded in documents. WMF files are legacy vector graphic formats that can be integrated into various document types, allowing attackers to craft malicious files containing specially constructed graphical elements designed to exploit parsing logic errors during import operations. The specific flaw resides in the handling of text records within these metafiles, particularly those that define their own character advance widths. Character advances determine the horizontal spacing between characters when rendering text, and improper processing of this data can lead to significant memory corruption issues.
The technical root cause stems from a lack of validation regarding the consistency between two distinct data fields extracted from the WMF file: the count of advance values provided in the record and the actual length of the associated text string. The parser reads these two metrics independently without enforcing a constraint that they must match or align logically. When the application proceeds to render the text, it iterates through the character positions using an index derived from the text length but accesses elements within the advance array based on its own size. If the advance array is shorter than the text string, the iteration logic continues past the allocated bounds of the heap-allocated array. This out-of-bounds read results in a heap buffer overflow, potentially allowing for arbitrary code execution if an attacker can control the memory layout and exploit the corrupted data structures to redirect program flow or inject malicious shellcode into the process space.
From a security classification perspective, this vulnerability aligns with CWE-120, which describes Buffer Copy without Checking Size of Input (Classic Buffer Overflow), specifically manifesting as a heap-based overflow due to insufficient boundary checks during array access. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates initial code execution through document exploitation techniques often categorized under Tactic TA0002 Execution and Technique T1204 User Execution, where the victim is tricked into opening a malicious file that triggers the vulnerability within the application runtime. The impact of successfully exploiting this heap overflow extends beyond simple data corruption; it can lead to complete compromise of the host system by executing arbitrary commands with the privileges of the user running LibreOffice.
Mitigation strategies for this vulnerability primarily involve updating to patched versions of LibreOffice where the parsing logic has been hardened. In fixed releases, the application implements a defensive check that ignores any advance array if its length is shorter than the corresponding text string, thereby preventing the out-of-bounds access from occurring during rendering operations. Users should ensure their office suite software is kept up-to-date to benefit from these security patches. Additionally, organizations can reduce risk by configuring document handling policies to restrict or disable automatic import of embedded WMF graphics and other legacy vector formats that are less commonly required in modern workflows, thereby reducing the attack surface available to adversaries attempting to deliver exploit payloads via malicious documents.