CVE-2026-50593

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.

Graphite is a system that can be used to create “smart fonts” capable of displaying writing systems with various complex behaviors. A smart font contains not only letter shapes but also additional instructions indicating how to combine and position the letters in complex ways.

Security Fix(es):

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.(CVE-2026-50593)

Graphite is a system that can be used to create “smart fonts” capable of displaying writing systems with various complex behaviors. A smart font contains not only letter shapes but also additional instructions indicating how to combine and position the letters in complex ways.

Security Fix(es):

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.(CVE-2026-50593)

Graphite is a system that can be used to create “smart fonts” capable of displaying writing systems with various complex behaviors. A smart font contains not only letter shapes but also additional instructions indicating how to combine and position the letters in complex ways.

Security Fix(es):

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.(CVE-2026-50593)

Graphite is a system that can be used to create “smart fonts” capable of displaying writing systems with various complex behaviors. A smart font contains not only letter shapes but also additional instructions indicating how to combine and position the letters in complex ways.

Security Fix(es):

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.(CVE-2026-50593)

Graphite is a system that can be used to create “smart fonts” capable of displaying writing systems with various complex behaviors. A smart font contains not only letter shapes but also additional instructions indicating how to combine and position the letters in complex ways.

Security Fix(es):

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.(CVE-2026-50593)

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.

The updated packages fix a security vulnerability: Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range. (CVE-2026-50593)

These are all security issues fixed in the graphite2-1.3.15-1.1 package on the GA media of openSUSE Tumbleweed.

This update for graphite2 fixes the following issue

• CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

Root has patched CVE-2026-50593 in the graphite2 package for Root:Debian:11. Multiple fixed versions available.

This update for graphite2 fixes the following issue

• CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

This update for graphite2 fixes the following issue

• CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

This update for graphite2 fixes the following issue

• CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

This update for graphite2 fixes the following issue

• CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

This update for graphite2 fixes the following issue

• CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

This update for graphite2 fixes the following issue:

• CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

This update for graphite2 fixes the following issue:

• CVE-2026-50593: Out-of-bounds write via Graphite actions (bsc#1267733).

This update for libreoffice fixes the following issues:

Update to LibreOffice 26.2.5.1.

Security issues fixed:

• CVE-2026-4430: out-of-bounds write via crafted OOXML documents with mismatched encryption salt parameters (bsc#1264357).
• CVE-2026-6039: denial of service via specially crafted DXF polyline import (bsc#1268494).
• CVE-2026-6040: heap use-after-free when importing the blank-width characters of an ODF number format (bsc#1268527).
• CVE-2026-6045: heap buffer overflow via crafted EMF+ graphics import (bsc#1268497).
• CVE-2026-6047: denial of service via heap buffer overflow in OOXML document processing (bsc#1268504).
• CVE-2026-8356: denial of service via a specially crafted PPT file (bsc#1268522).
• CVE-2026-8357: heap buffer overflow in Calc formula compilation (bsc#1268528).
• CVE-2026-8358: heap buffer overflow in spreadsheet tracked-changes import (bsc#1268529).
• CVE-2026-50593: graphite2: out-of-bounds write via Graphite actions (bsc#1267735).

Other updates and bugfixes:

• Update to LibreOffice 26.2.5.1.
  • Update bundled dependencies:
    • fontconfig 2.17.1 -> 2.18.0
    • graphite2-minimal 1.3.14 -> 1.3.15
    • libcmis 0.6.2 -> 0.6.3
    • libgpg-error 1.59 -> 1.61
    • lxml 6.1.0 -> 6.1.1
    • md4c 0.5.2 -> 0.5.3
    • poppler 26.04.0 -> 26.06.0
    • sqlite-amalgamation 3530000 -> 3530100
    • xmlsec1 1.3.9 -> 1.3.11
• Update to LibreOffice 26.2.3.2 (PED-16098).
  • Upgraded dependencies:
    • boost: 1_88_0 -> 1_89_0
    • freetype: 2.14.1 -> 2.14.3
    • harfbuzz: 12.3.0 -> 12.3.2
    • icu4c: 77_1 -> 78.3
    • libgpg-error: 1.56 -> 1.59
    • liborcus: 0.20.1 -> 0.21.0
    • pdfium: 7012 -> 7471
    • poppler: 25.12.0 -> 26.04.0
    • skia: m136 -> m142
  • New bundled sources:
    • afdko 4.0.3
    • antlr4-cpp-runtime 4.13.2
    • fast_float 8.2.2
    • libffi 3.5.2
    • lxml 6.1.0
    • md4c 0.5.2
    • meson 1.8.3
    • Python 3.12.13
    • sqlite 3530000
    • xmlsec1 1.3.9
    • xz 5.8.3
• Add patch, required to build the bundled Python on all architectures.
• Bundling a specific Python is now required as the one we ship (3.6) is too old to build harfbuzz.

It was discovered that Graphite incorrectly handled memory when running certain actions. An attacker could use this issue to cause Graphite to crash, resulting in a denial of service, or possibly execute arbitrary code.

It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-63272)

It was discovered that LibreOffice incorrectly handled PDF document imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-63273, CVE-2026-63274)

It was discovered that LibreOffice incorrectly handled CFF fonts embedded in documents. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-63275, CVE-2026-63276)

It was discovered that LibreOffice incorrectly validated package URLs. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-63278)

It was discovered that LibreOffice incorrectly handled PICT image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or obtain sensitive information. (CVE-2026-63279)

It was discovered that LibreOffice incorrectly mitigated out-of-bounds writes via Graphite font actions. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-50593)