CVE-2026-63279 in LibreOffice
Summary
by MITRE • 09/22/2026
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in LibreOffice pertains to a critical out-of-bounds read flaw within the component responsible for importing PICT image formats that utilize color palettes. This issue arises specifically when documents containing embedded images are processed by the application, highlighting a deficiency in input validation during the parsing of graphical data structures. The core technical failure lies in the handling of palette indices found within the image metadata. When LibreOffice encounters a PICT file with an associated color palette, it extracts index values that point to specific colors within that palette. However, prior to this fix, the software failed to verify whether these extracted indices were valid relative to the actual size or number of entries defined in the palette structure. Consequently, if an image data stream contained an index value exceeding the bounds of the allocated palette array, the application would proceed to read memory locations beyond the intended buffer boundary.
This type of vulnerability is classified under CWE-125, which describes out-of-bounds read errors where a program reads data past the end or before the beginning of the intended buffer. In the context of LibreOffice, this flaw allows for potential information disclosure rather than immediate code execution, as reading memory outside the palette typically results in leaking sensitive data from adjacent memory regions into the application's process space. An attacker could craft a malicious document containing a specially constructed PICT image with an invalid color index to trigger this condition. While out-of-bounds reads are generally less severe than buffer overflows that allow for arbitrary write operations, they remain significant security risks because they can expose internal state information, cryptographic keys, or other sensitive data stored in memory adjacent to the palette structure. This aligns with ATT&CK technique T1005, which covers Data from Local System Retrieval, as the vulnerability facilitates unauthorized access to local system memory contents through a trusted application vector.
The operational impact of this flaw extends beyond simple data leakage. It undermines the integrity and reliability of document processing workflows by introducing instability into the rendering engine. If the out-of-bounds read accesses protected or unmapped memory pages, it may cause LibreOffice to crash unexpectedly, leading to denial of service conditions for users relying on the software for critical tasks. Furthermore, in complex scenarios where such reads are part of a larger exploitation chain, they could potentially aid attackers in bypassing security mitigations like Address Space Layout Randomization by leaking address information from memory. The presence of this vulnerability indicates that input validation mechanisms were insufficiently robust when handling external file formats, particularly those with legacy structures like PICT which may have variable and less strictly defined boundaries compared to modern image formats.
To mitigate the risks associated with this out-of-bounds read, users must ensure they are running a version of LibreOffice where the palette index is properly bounded against the actual number of entries present in the color table. The fix involves implementing strict bounds checking logic that validates every palette index retrieved from the image data before it is used to access memory. This defensive programming practice ensures that any index value exceeding the maximum valid entry triggers an error or default behavior rather than proceeding with a potentially dangerous memory read. Additionally, organizations should enforce policies regarding the import of embedded objects and images from untrusted sources, as these remain primary vectors for such vulnerabilities. Regular updates to office productivity suites are essential to patch these low-level parsing flaws that attackers frequently target due to their prevalence in document handling software.