{"id":"CVE-2026-63269","aliases":["BELL-CVE-2026-63269","DEBIAN-CVE-2026-63269","EUVD-2026-92420","GHSA-hx75-xjjr-jmv5","MGASA-2026-0514","UBUNTU-CVE-2026-63269"],"status":"published","title":"LFI and GET SSRF via GStreamer and HLS playlists","description":"LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.","severity":{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00109,"percentile":0.01263,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-918"],"published":"2026-10-05T11:17:23Z","modified":"2026-10-23T07:15:04Z","fixes":[{"ecosystem":"Debian:13","package":"libreoffice","fixed_in":["4:25.2.3-2+deb13u8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libreoffice","fixed_in":["4:26.2.5.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:24.2.0-1","4:24.2.0-1~bpo12+1","4:24.2.0-2","4:24.2.0-3","4:24.2.0~alpha1-1","4:24.2.0~beta1-1","4:24.2.0~rc1-1","4:24.2.0~rc1-2","4:24.2.0~rc2-1","4:24.2.0~rc2-2","4:24.2.0~rc2-2~bpo12+1","4:24.2.1-1","4:24.2.1-2","4:24.2.1-3","4:24.2.1-4","4:24.2.1~rc1-1","4:24.2.1~rc2-1","4:24.2.2-1","4:24.2.2-2","4:24.2.2-3","4:24.2.2~rc1-1","4:24.2.2~rc1-2","4:24.2.2~rc2-1","4:24.2.2~rc2-2","4:24.2.3-1","4:24.2.3-1~bpo12+1","4:24.2.3-2","4:24.2.3~rc1-1","4:24.2.3~rc1-2","4:24.2.3~rc1-3","4:24.2.3~rc2-1","4:24.2.4-1","4:24.2.4-1~bpo12+1","4:24.2.5-1","4:24.2.5-1~bpo12+1","4:24.2.5-2","4:24.2.5-3","4:24.2.5-4","4:24.2.6-1","4:24.2.6-2","4:24.2.6-2~bpo12+1","4:24.8.0~alpha1-1","4:24.8.0~alpha1-2","4:24.8.0~alpha1-3","4:24.8.0~alpha1-4","4:24.8.0~beta1-1","4:24.8.0~rc1-1","4:24.8.0~rc2-1","4:24.8.0~rc3-1","4:24.8.0~rc3-2","4:24.8.1-1","4:24.8.1-2","4:24.8.1~rc1-1","4:24.8.2-1","4:24.8.2-1~bpo12+1","4:24.8.2-2","4:24.8.2~rc1-1","4:24.8.3-1","4:24.8.3-1~bpo12+1","4:24.8.3-2","4:24.8.3-3","4:24.8.4-1","4:24.8.4-1~bpo12+1","4:24.8.4-2","4:24.8.4-3","4:24.8.4-4","4:24.8.5-1","4:24.8.5-2","4:24.8.5-2~bpo12+1","4:24.8.5-2~bpo12+2","4:25.2.0~alpha1-1","4:25.2.0~beta1-1","4:25.2.0~beta1-2","4:25.2.0~rc1-1","4:25.2.0~rc1-2","4:25.2.0~rc1-3","4:25.2.0~rc1-4","4:25.2.0~rc2-1","4:25.2.0~rc3-1","4:25.2.0~rc3-2","4:25.2.1-1","4:25.2.1-2","4:25.2.1-3","4:25.2.1-3~bpo12+1","4:25.2.1~rc1-1","4:25.2.1~rc1-2","4:25.2.1~rc2-1","4:25.2.2-1","4:25.2.2-1~bpo12+1","4:25.2.2-2","4:25.2.2-3","4:25.2.2-3~bpo12+1","4:25.2.2~rc1-1","4:25.2.2~rc2-1","4:25.2.3-1","4:25.2.3-2","4:25.2.3-2~bpo12+1","4:25.2.3~rc1-1","4:25.2.3~rc1-2","4:25.2.3~rc2-1","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2","4:26.2.3.2-2~bpo13+1","4:26.2.4.1-1","4:26.2.4.2-1","4:26.2.4.2-1~bpo13+1","4:26.2.4.2-2","4:26.2.5.2-1","4:26.2.5.2-2","4:26.2.5.2-2~bpo13+1","4:26.8.0.0.alpha1-1","4:26.8.0.0.alpha1-2","4:26.8.0.0.alpha1-3","4:26.8.0.0.alpha1-4","4:26.8.0.0.beta1-1","4:26.8.0.1-1","4:26.8.0.2-1","4:26.8.0.3-1","4:26.8.0.3-2","4:26.8.0.3-2~bpo13+1","4:26.8.1.1-1","4:26.8.1.1-2","4:26.8.1.1-3","4:7.4.5-3","4:7.4.7-1","4:7.4.7-1+deb12u1","4:7.4.7-1+deb12u10","4:7.4.7-1+deb12u11","4:7.4.7-1+deb12u12","4:7.4.7-1+deb12u13","4:7.4.7-1+deb12u14","4:7.4.7-1+deb12u1~bpo11+1","4:7.4.7-1+deb12u2","4:7.4.7-1+deb12u2~bpo11+1","4:7.4.7-1+deb12u3","4:7.4.7-1+deb12u4","4:7.4.7-1+deb12u5","4:7.4.7-1+deb12u6","4:7.4.7-1+deb12u7","4:7.4.7-1+deb12u8","4:7.4.7-1+deb12u9","4:7.4.7-1~bpo11+1","4:7.5.0~rc2-7","4:7.5.0~rc3-1","4:7.5.1~rc1-1","4:7.5.1~rc2-1","4:7.5.2~rc1-1","4:7.5.2~rc2-1","4:7.5.3~rc1-1","4:7.5.3~rc2-1","4:7.5.4-1","4:7.5.4-2","4:7.5.4-3","4:7.5.4-4","4:7.5.4~rc1-1","4:7.5.4~rc1-2","4:7.5.4~rc1-3","4:7.5.4~rc1-4","4:7.5.4~rc2-1","4:7.5.5-1","4:7.5.5-2","4:7.5.5-3","4:7.5.5-3~bpo12+1","4:7.5.5-4","4:7.5.5-4~bpo12+1","4:7.5.5~rc1-1","4:7.5.5~rc1-2","4:7.5.5~rc1-3","4:7.5.5~rc1-4","4:7.5.5~rc1-5","4:7.5.5~rc2-1","4:7.5.6-1","4:7.5.6-1~bpo12+1","4:7.5.7-1","4:7.5.8-1","4:7.5.8-1~bpo12+1","4:7.5.8~rc1-1","4:7.5.8~rc1-2","4:7.5.9~rc1-1","4:7.5.9~rc1-1~bpo12+1","4:7.5.9~rc1-1~bpo12+2","4:7.6.0~rc1-1","4:7.6.0~rc1-2","4:7.6.0~rc2-1","4:7.6.0~rc2-2","4:7.6.0~rc3-1","4:7.6.1~rc1-1","4:7.6.1~rc2-1","4:7.6.1~rc2-2","4:7.6.2-1","4:7.6.2-2","4:7.6.2-3","4:7.6.2-4","4:7.6.2-5","4:7.6.3-1","4:7.6.3-2","4:7.6.3~rc1-1","4:7.6.3~rc1-2","4:7.6.3~rc2-1","4:7.6.3~rc2-2","4:7.6.4~rc1-1","4:7.6.4~rc1-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:25.2.3-2+deb13u8"}]}],"versions":["4:25.2.3-2","4:25.2.3-2+deb13u1","4:25.2.3-2+deb13u2","4:25.2.3-2+deb13u2~bpo12+1","4:25.2.3-2+deb13u3","4:25.2.3-2+deb13u3~bpo12+1","4:25.2.3-2+deb13u4","4:25.2.3-2+deb13u5","4:25.2.3-2+deb13u5~bpo12+1","4:25.2.3-2+deb13u6","4:25.2.3-2+deb13u7"]},{"source":"osv","ecosystem":"Debian:14","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.5.2-1"}]}],"versions":["4:25.2.3-2","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2","4:26.2.3.2-2~bpo13+1","4:26.2.4.1-1","4:26.2.4.2-1","4:26.2.4.2-1~bpo13+1","4:26.2.4.2-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.6.3-1.mga10"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.3.2-0ubuntu2","1:6.3.3-0ubuntu1","1:6.3.3-0ubuntu2","1:6.3.4-0ubuntu1","1:6.4.0-0ubuntu4","1:6.4.0-0ubuntu6","1:6.4.0-0ubuntu7","1:6.4.1-0ubuntu1","1:6.4.2-0ubuntu1","1:6.4.2-0ubuntu2","1:6.4.2-0ubuntu3","1:6.4.3-0ubuntu0.20.04.1","1:6.4.4-0ubuntu0.20.04.1","1:6.4.5-0ubuntu0.20.04.1","1:6.4.6-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.2","1:6.4.7-0ubuntu0.20.04.4","1:6.4.7-0ubuntu0.20.04.5","1:6.4.7-0ubuntu0.20.04.6","1:6.4.7-0ubuntu0.20.04.7","1:6.4.7-0ubuntu0.20.04.8","1:6.4.7-0ubuntu0.20.04.9","1:6.4.7-0ubuntu0.20.04.10","1:6.4.7-0ubuntu0.20.04.11","1:6.4.7-0ubuntu0.20.04.12","1:6.4.7-0ubuntu0.20.04.13","1:6.4.7-0ubuntu0.20.04.14","1:6.4.7-0ubuntu0.20.04.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.2.1-0ubuntu3","1:7.2.2-0ubuntu0.21.10.1","1:7.2.3~rc2-0ubuntu1","1:7.2.4-0ubuntu1","1:7.2.5~rc1-0ubuntu2","1:7.2.5~rc2-0ubuntu1","1:7.3.1~rc2-0ubuntu1","1:7.3.1~rc3-0ubuntu1","1:7.3.2~rc1-0ubuntu2","1:7.3.2~rc2-0ubuntu1","1:7.3.2-0ubuntu1","1:7.3.2-0ubuntu2","1:7.3.3-0ubuntu0.22.04.1","1:7.3.4-0ubuntu0.22.04.1","1:7.3.5-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.1","1:7.3.7-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.3","1:7.3.7-0ubuntu0.22.04.4","1:7.3.7-0ubuntu0.22.04.5","1:7.3.7-0ubuntu0.22.04.6","1:7.3.7-0ubuntu0.22.04.7","1:7.3.7-0ubuntu0.22.04.8","1:7.3.7-0ubuntu0.22.04.9","1:7.3.7-0ubuntu0.22.04.10","1:7.3.7-0ubuntu0.22.04.11","1:7.3.7-0ubuntu0.22.04.12","1:7.3.7-0ubuntu0.22.04.13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5","4:24.2.7-0ubuntu0.24.04.6","4:24.2.7-0ubuntu0.24.04.7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:26.2.2.2-0ubuntu1","4:26.2.4.2-0ubuntu1","4:26.2.5.1-0ubuntu1","4:26.2.5.2-0ubuntu3","4:26.8.0.3-0ubuntu1","4:26.8.1.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.2","4:26.2.5.2-0ubuntu0.26.04.1","4:26.2.6.3-0ubuntu0.26.04.2"]}],"products":[{"vendor":"the document foundation","product":"libreoffice"}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-63269"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63269"},{"url":"https://github.com/advisories/GHSA-hx75-xjjr-jmv5"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-63269","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63269","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0514.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36383","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00424.html","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63272","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63273","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63274","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63275","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63276","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63277","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63278","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63279","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00457.html","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63266","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63267","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63268","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63269","tags":["web","report"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63270","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8868-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63269","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-63269","title":"LFI and GET SSRF via GStreamer and HLS playlists","description":"LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.","status":"published","published":"2026-10-05T11:17:23.64Z","modified":"2026-10-05T12:40:50.818Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918","CWE-200"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-92420","description":"LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.","status":"published","published":"2026-10-05T11:17:23Z","modified":"2026-10-05T12:40:50Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:40.198021Z"}],"ghsa":[{"id":"GHSA-hx75-xjjr-jmv5","title":"LibreOffice can link to audio and video files from a document, and on Linux it plays them with...","description":"LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.","status":"published","published":"2026-10-05T12:31:28Z","modified":"2026-10-05T12:31:34Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:12:48.068686Z"}],"nvd":[{"id":"CVE-2026-63269","description":"LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.","status":"published","published":"2026-10-05T12:17:10.98Z","modified":"2026-10-06T15:03:59.427Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-918"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"DEBIAN-CVE-2026-63269","description":"LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.","status":"published","published":"2026-10-05T12:17:10.98Z","modified":"2026-10-07T09:47:31.914553985Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-63269","description":"LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.","status":"published","published":"2026-10-05T12:17:00Z","modified":"2026-10-17T12:59:16.593804097Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"BELL-CVE-2026-63269","title":"CVE-2026-63269 does not affect BellSoft software","status":"withdrawn","published":"2026-10-07T06:05:20.538461Z","modified":"2026-10-23T07:15:04.231659969Z","updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"MGASA-2026-0514","title":"Updated libreoffice package fixes security vulnerabilities","description":"Arbitrary file write via calcext:data-mappings, sql provider and\nFirebird backup functionality. (CVE-2026-63266)\nLFI and GET SSRF via calcext:data-mappings and csv provider.\n(CVE-2026-63267)\nLFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db\nhref. (CVE-2026-63268)\nLFI and GET SSRF via GStreamer and HLS playlists. (CVE-2026-63269)\nEnvironment/ini-file leaks. (CVE-2026-63270)\nHeap buffer overflow in WMF text record import. (CVE-2026-63272)\nHeap buffer overflow in PDF import encryption handling. (CVE-2026-63273)\nHeap buffer overflow in PDF import stream handling. (CVE-2026-63274)\nStack buffer overflow in CFF font hint handling. (CVE-2026-63275)\nStack buffer overflow in CFF to Type 1 font conversion. (CVE-2026-63276)\nRCE via calcext:data-mappings, sql provider and jdbc connector.\n(CVE-2026-63277)\nPackage URLs can be used to exfiltrate arbitrary INI file values and\nenvironment variables. (CVE-2026-63278)\nOut of bounds read in PICT image import. (CVE-2026-63279)\n","status":"published","published":"2026-10-17T03:21:49Z","modified":"2026-10-17T03:30:03.784898295Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}