CVE-2026-63278 in LibreOffice
Summary
by MITRE • 09/22/2026
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability described involves an improper restriction of information access within document processing software, specifically related to how URLs are parsed and expanded before being resolved or fetched. This issue allows for the construction of maliciously crafted Uniform Resource Locators that can trigger the expansion of environment variables or values stored in INI configuration files during the rendering or loading phase of a document. When an unsuspecting user opens a file containing such links, the application processes these URLs through internal logic designed to resolve relative paths and expand variable placeholders for convenience or functionality. However, due to insufficient validation mechanisms, this expansion process can be abused by attackers to read sensitive local data from the victim's system environment or configuration files. The expanded values are then incorporated into the final URL request, which is subsequently sent to a remote server controlled by an attacker, resulting in unauthorized exfiltration of potentially confidential information such as file paths, user credentials stored in configurations, or other system-specific details that could aid further attacks.
This specific flaw represents a bypass of previous security controls implemented for CVE-2024-12426. The earlier fix attempted to restrict the expansion mechanism by checking if the URL referenced package content providers, which are internal resources used by applications to access bundled assets or data. However, the validation logic was incomplete because it failed to recognize every possible naming convention or identifier for these package content providers. Consequently, an attacker could circumvent this check simply by using a slightly different name or format when referencing the provider in the URL. This oversight meant that even with the previous patch applied, certain variations of malicious URLs would still pass through the security filter and reach the expansion routine, allowing the data leakage to persist. The root cause lies in the rigid or incomplete pattern matching used during the validation phase, which did not account for all valid ways a package content provider might be addressed within the application's internal URL scheme parser.
In fixed versions of the software, this vulnerability is mitigated by enhancing the URL checking logic to ensure that the package content provider is correctly and comprehensively matched regardless of its specific naming variation. The updated validation routine now properly identifies all relevant identifiers for package content providers before allowing any expansion operations to proceed. By tightening this check, the application prevents malicious URLs from triggering the environment variable or INI file expansion when they are intended to access restricted internal resources. This ensures that only legitimate and expected resource requests are processed through the expansion mechanism, thereby closing the pathway used for data exfiltration. The fix aligns with security best practices by enforcing strict allow-listing or robust pattern matching for sensitive operations involving system-level variables and configuration files within document parsers.
From a classification perspective, this vulnerability falls under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, as it leads to the leakage of internal system data through URL manipulation. It also relates closely to CWE-798: Use of Hard-coded Credentials if sensitive values are stored in configuration files and accessed via these expanded URLs. Furthermore, this attack vector aligns with MITRE ATT&CK technique T1059.004: Command and Scripting Interpreter, specifically through the abuse of environment variables or system configurations to facilitate data staging and exfiltration. The operational impact is significant for organizations relying on document processing tools that handle untrusted input, as it enables remote code execution prerequisites such as reconnaissance and initial access facilitation without requiring direct user interaction beyond opening a file. Mitigation strategies include applying the latest software updates provided by the vendor to ensure the comprehensive URL validation logic is in place. Additionally, users should be educated on the risks of opening documents from untrusted sources, and network-level controls can be implemented to monitor for unusual outbound traffic patterns that may indicate data exfiltration attempts via DNS or HTTP requests containing encoded sensitive information.