CVE-2026-63275 in LibreOffice
Summary
by MITRE • 09/22/2026
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in LibreOffice represents a critical memory safety issue within the application's font rendering engine, specifically affecting the handling of Compact Font Format (CFF) fonts that are embedded directly into document files. CFF is a widely used format for storing PostScript Type 1 and OpenType fonts, characterized by its efficiency and support for complex glyph outlines. When LibreOffice processes these documents, it must parse the font data to render text correctly on screen or during printing. The core of this vulnerability lies in the parsing logic responsible for interpreting glyph hints, which are instructions embedded within the CFF structure that guide how a character's outline should be scaled and rendered at different point sizes.
The technical flaw is classified as a stack-based buffer overflow resulting from an improper boundary check during the processing of these hint arrays. Specifically, when LibreOffice reads the metadata for a glyph, it allocates a fixed-size array on the stack to store the parsed hints. The software performs a validation step to ensure that the number of hints declared in the font file does not exceed the capacity of this allocated buffer. However, due to a logic error, the application checks the hint count against an incorrect bound value rather than the actual size of the destination array. This discrepancy allows a maliciously crafted CFF font with a high hint count to bypass the validation check and write data beyond the end of the stack-allocated buffer.
This out-of-bounds write operation has severe operational implications for system security. Because the overflow occurs on the stack, an attacker can potentially overwrite adjacent memory locations that contain critical control flow information, such as return addresses or function pointers. By carefully crafting the payload within the font file, a remote attacker could achieve arbitrary code execution with the privileges of the user running LibreOffice. This transforms what appears to be a simple document viewing action into a vector for full system compromise without requiring any additional interaction from the victim beyond opening the malicious file in an affected version of the software.
From a classification perspective, this vulnerability aligns with CWE-121, which denotes a stack-based buffer overflow caused by copying data to a fixed-size buffer on the call stack without proper bounds checking. It also relates to CWE-20, Improper Input Validation, as the application fails to correctly validate the size of incoming font data against the allocated memory resources. In terms of offensive security frameworks, this exploit path is consistent with ATT&CK technique T1203, Exploitation for Client Execution, where attackers use malicious files like documents or images to trigger code execution on a victim's machine through trusted applications.
To mitigate this risk, organizations and individual users must ensure that LibreOffice is updated to the latest stable release where the hint count validation logic has been corrected to check against the actual array capacity rather than an erroneous bound value. Security administrators should enforce strict software update policies for office productivity suites, as these are frequent targets for drive-by download attacks using malicious documents. Additionally, deploying application whitelisting or sandboxing solutions can help contain potential exploits by restricting the ability of LibreOffice processes to execute arbitrary code even if a vulnerability is triggered. Users should also be educated on the risks of opening document attachments from untrusted sources, particularly those containing embedded fonts or complex formatting that may trigger such parsing routines.