{"id":"CVE-2026-63273","aliases":["DEBIAN-CVE-2026-63273","EUVD-2026-84353","GHSA-254q-47m3-r67w","MGASA-2026-0514","UBUNTU-CVE-2026-63273","USN-8868-1"],"status":"published","title":"Heap buffer overflow in PDF import encryption handling","description":"LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00127,"percentile":0.02368,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-09-22T11:10:13Z","modified":"2026-10-17T03:30:03Z","fixes":[{"ecosystem":"Debian:13","package":"libreoffice","fixed_in":["4:25.2.3-2+deb13u7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libreoffice","fixed_in":["4:26.2.5.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","fixed_in":["1:7.3.7-0ubuntu0.22.04.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","fixed_in":["4:24.2.7-0ubuntu0.24.04.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","fixed_in":["4:26.2.6.3-0ubuntu0.26.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:24.2.0-1","4:24.2.0-1~bpo12+1","4:24.2.0-2","4:24.2.0-3","4:24.2.0~alpha1-1","4:24.2.0~beta1-1","4:24.2.0~rc1-1","4:24.2.0~rc1-2","4:24.2.0~rc2-1","4:24.2.0~rc2-2","4:24.2.0~rc2-2~bpo12+1","4:24.2.1-1","4:24.2.1-2","4:24.2.1-3","4:24.2.1-4","4:24.2.1~rc1-1","4:24.2.1~rc2-1","4:24.2.2-1","4:24.2.2-2","4:24.2.2-3","4:24.2.2~rc1-1","4:24.2.2~rc1-2","4:24.2.2~rc2-1","4:24.2.2~rc2-2","4:24.2.3-1","4:24.2.3-1~bpo12+1","4:24.2.3-2","4:24.2.3~rc1-1","4:24.2.3~rc1-2","4:24.2.3~rc1-3","4:24.2.3~rc2-1","4:24.2.4-1","4:24.2.4-1~bpo12+1","4:24.2.5-1","4:24.2.5-1~bpo12+1","4:24.2.5-2","4:24.2.5-3","4:24.2.5-4","4:24.2.6-1","4:24.2.6-2","4:24.2.6-2~bpo12+1","4:24.8.0~alpha1-1","4:24.8.0~alpha1-2","4:24.8.0~alpha1-3","4:24.8.0~alpha1-4","4:24.8.0~beta1-1","4:24.8.0~rc1-1","4:24.8.0~rc2-1","4:24.8.0~rc3-1","4:24.8.0~rc3-2","4:24.8.1-1","4:24.8.1-2","4:24.8.1~rc1-1","4:24.8.2-1","4:24.8.2-1~bpo12+1","4:24.8.2-2","4:24.8.2~rc1-1","4:24.8.3-1","4:24.8.3-1~bpo12+1","4:24.8.3-2","4:24.8.3-3","4:24.8.4-1","4:24.8.4-1~bpo12+1","4:24.8.4-2","4:24.8.4-3","4:24.8.4-4","4:24.8.5-1","4:24.8.5-2","4:24.8.5-2~bpo12+1","4:24.8.5-2~bpo12+2","4:25.2.0~alpha1-1","4:25.2.0~beta1-1","4:25.2.0~beta1-2","4:25.2.0~rc1-1","4:25.2.0~rc1-2","4:25.2.0~rc1-3","4:25.2.0~rc1-4","4:25.2.0~rc2-1","4:25.2.0~rc3-1","4:25.2.0~rc3-2","4:25.2.1-1","4:25.2.1-2","4:25.2.1-3","4:25.2.1-3~bpo12+1","4:25.2.1~rc1-1","4:25.2.1~rc1-2","4:25.2.1~rc2-1","4:25.2.2-1","4:25.2.2-1~bpo12+1","4:25.2.2-2","4:25.2.2-3","4:25.2.2-3~bpo12+1","4:25.2.2~rc1-1","4:25.2.2~rc2-1","4:25.2.3-1","4:25.2.3-2","4:25.2.3-2~bpo12+1","4:25.2.3~rc1-1","4:25.2.3~rc1-2","4:25.2.3~rc2-1","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2","4:26.2.3.2-2~bpo13+1","4:26.2.4.1-1","4:26.2.4.2-1","4:26.2.4.2-1~bpo13+1","4:26.2.4.2-2","4:26.2.5.2-1","4:26.2.5.2-2","4:26.2.5.2-2~bpo13+1","4:26.8.0.0.alpha1-1","4:26.8.0.0.alpha1-2","4:26.8.0.0.alpha1-3","4:26.8.0.0.alpha1-4","4:26.8.0.0.beta1-1","4:26.8.0.1-1","4:26.8.0.2-1","4:26.8.0.3-1","4:26.8.0.3-2","4:26.8.0.3-2~bpo13+1","4:26.8.1.1-1","4:7.4.5-3","4:7.4.7-1","4:7.4.7-1+deb12u1","4:7.4.7-1+deb12u10","4:7.4.7-1+deb12u11","4:7.4.7-1+deb12u12","4:7.4.7-1+deb12u13","4:7.4.7-1+deb12u14","4:7.4.7-1+deb12u1~bpo11+1","4:7.4.7-1+deb12u2","4:7.4.7-1+deb12u2~bpo11+1","4:7.4.7-1+deb12u3","4:7.4.7-1+deb12u4","4:7.4.7-1+deb12u5","4:7.4.7-1+deb12u6","4:7.4.7-1+deb12u7","4:7.4.7-1+deb12u8","4:7.4.7-1+deb12u9","4:7.4.7-1~bpo11+1","4:7.5.0~rc2-7","4:7.5.0~rc3-1","4:7.5.1~rc1-1","4:7.5.1~rc2-1","4:7.5.2~rc1-1","4:7.5.2~rc2-1","4:7.5.3~rc1-1","4:7.5.3~rc2-1","4:7.5.4-1","4:7.5.4-2","4:7.5.4-3","4:7.5.4-4","4:7.5.4~rc1-1","4:7.5.4~rc1-2","4:7.5.4~rc1-3","4:7.5.4~rc1-4","4:7.5.4~rc2-1","4:7.5.5-1","4:7.5.5-2","4:7.5.5-3","4:7.5.5-3~bpo12+1","4:7.5.5-4","4:7.5.5-4~bpo12+1","4:7.5.5~rc1-1","4:7.5.5~rc1-2","4:7.5.5~rc1-3","4:7.5.5~rc1-4","4:7.5.5~rc1-5","4:7.5.5~rc2-1","4:7.5.6-1","4:7.5.6-1~bpo12+1","4:7.5.7-1","4:7.5.8-1","4:7.5.8-1~bpo12+1","4:7.5.8~rc1-1","4:7.5.8~rc1-2","4:7.5.9~rc1-1","4:7.5.9~rc1-1~bpo12+1","4:7.5.9~rc1-1~bpo12+2","4:7.6.0~rc1-1","4:7.6.0~rc1-2","4:7.6.0~rc2-1","4:7.6.0~rc2-2","4:7.6.0~rc3-1","4:7.6.1~rc1-1","4:7.6.1~rc2-1","4:7.6.1~rc2-2","4:7.6.2-1","4:7.6.2-2","4:7.6.2-3","4:7.6.2-4","4:7.6.2-5","4:7.6.3-1","4:7.6.3-2","4:7.6.3~rc1-1","4:7.6.3~rc1-2","4:7.6.3~rc2-1","4:7.6.3~rc2-2","4:7.6.4~rc1-1","4:7.6.4~rc1-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:25.2.3-2+deb13u7"}]}],"versions":["4:25.2.3-2","4:25.2.3-2+deb13u1","4:25.2.3-2+deb13u2","4:25.2.3-2+deb13u2~bpo12+1","4:25.2.3-2+deb13u3","4:25.2.3-2+deb13u3~bpo12+1","4:25.2.3-2+deb13u4","4:25.2.3-2+deb13u5","4:25.2.3-2+deb13u5~bpo12+1","4:25.2.3-2+deb13u6"]},{"source":"osv","ecosystem":"Debian:14","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.5.2-1"}]}],"versions":["4:25.2.3-2","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2","4:26.2.3.2-2~bpo13+1","4:26.2.4.1-1","4:26.2.4.2-1","4:26.2.4.2-1~bpo13+1","4:26.2.4.2-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.6.3-1.mga10"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.3.2-0ubuntu2","1:6.3.3-0ubuntu1","1:6.3.3-0ubuntu2","1:6.3.4-0ubuntu1","1:6.4.0-0ubuntu4","1:6.4.0-0ubuntu6","1:6.4.0-0ubuntu7","1:6.4.1-0ubuntu1","1:6.4.2-0ubuntu1","1:6.4.2-0ubuntu2","1:6.4.2-0ubuntu3","1:6.4.3-0ubuntu0.20.04.1","1:6.4.4-0ubuntu0.20.04.1","1:6.4.5-0ubuntu0.20.04.1","1:6.4.6-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.2","1:6.4.7-0ubuntu0.20.04.4","1:6.4.7-0ubuntu0.20.04.5","1:6.4.7-0ubuntu0.20.04.6","1:6.4.7-0ubuntu0.20.04.7","1:6.4.7-0ubuntu0.20.04.8","1:6.4.7-0ubuntu0.20.04.9","1:6.4.7-0ubuntu0.20.04.10","1:6.4.7-0ubuntu0.20.04.11","1:6.4.7-0ubuntu0.20.04.12","1:6.4.7-0ubuntu0.20.04.13","1:6.4.7-0ubuntu0.20.04.14","1:6.4.7-0ubuntu0.20.04.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3.7-0ubuntu0.22.04.13"}]}],"versions":["1:7.2.1-0ubuntu3","1:7.2.2-0ubuntu0.21.10.1","1:7.2.3~rc2-0ubuntu1","1:7.2.4-0ubuntu1","1:7.2.5~rc1-0ubuntu2","1:7.2.5~rc2-0ubuntu1","1:7.3.1~rc2-0ubuntu1","1:7.3.1~rc3-0ubuntu1","1:7.3.2~rc1-0ubuntu2","1:7.3.2~rc2-0ubuntu1","1:7.3.2-0ubuntu1","1:7.3.2-0ubuntu2","1:7.3.3-0ubuntu0.22.04.1","1:7.3.4-0ubuntu0.22.04.1","1:7.3.5-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.1","1:7.3.7-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.3","1:7.3.7-0ubuntu0.22.04.4","1:7.3.7-0ubuntu0.22.04.5","1:7.3.7-0ubuntu0.22.04.6","1:7.3.7-0ubuntu0.22.04.7","1:7.3.7-0ubuntu0.22.04.8","1:7.3.7-0ubuntu0.22.04.9","1:7.3.7-0ubuntu0.22.04.10","1:7.3.7-0ubuntu0.22.04.11","1:7.3.7-0ubuntu0.22.04.12"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.2.7-0ubuntu0.24.04.7"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5","4:24.2.7-0ubuntu0.24.04.6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.6.3-0ubuntu0.26.04.2"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.2","4:26.2.5.2-0ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3.7-0ubuntu0.22.04.13"}]}],"versions":["1:7.2.1-0ubuntu3","1:7.2.2-0ubuntu0.21.10.1","1:7.2.3~rc2-0ubuntu1","1:7.2.4-0ubuntu1","1:7.2.5~rc1-0ubuntu2","1:7.2.5~rc2-0ubuntu1","1:7.3.1~rc2-0ubuntu1","1:7.3.1~rc3-0ubuntu1","1:7.3.2~rc1-0ubuntu2","1:7.3.2~rc2-0ubuntu1","1:7.3.2-0ubuntu1","1:7.3.2-0ubuntu2","1:7.3.3-0ubuntu0.22.04.1","1:7.3.4-0ubuntu0.22.04.1","1:7.3.5-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.1","1:7.3.7-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.3","1:7.3.7-0ubuntu0.22.04.4","1:7.3.7-0ubuntu0.22.04.5","1:7.3.7-0ubuntu0.22.04.6","1:7.3.7-0ubuntu0.22.04.7","1:7.3.7-0ubuntu0.22.04.8","1:7.3.7-0ubuntu0.22.04.9","1:7.3.7-0ubuntu0.22.04.10","1:7.3.7-0ubuntu0.22.04.11","1:7.3.7-0ubuntu0.22.04.12"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.2.7-0ubuntu0.24.04.7"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5","4:24.2.7-0ubuntu0.24.04.6"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.6.3-0ubuntu0.26.04.2"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.2","4:26.2.5.2-0ubuntu0.26.04.1"],"bundled":8}],"products":[{"vendor":"the document foundation","product":"libreoffice"}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-63273","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63273"},{"url":"https://github.com/advisories/GHSA-254q-47m3-r67w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63273","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0514.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36383","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00424.html","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63272","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63273","tags":["web","report"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63274","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63275","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63276","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63277","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63278","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63279","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00457.html","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63266","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63267","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63268","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63269","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63270","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8868-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63273","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-50593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63279","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-63273","title":"Heap buffer overflow in PDF import encryption handling","description":"LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.","status":"published","published":"2026-09-22T11:10:13.896Z","modified":"2026-09-28T14:23:01.725Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-84353","description":"LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.","status":"published","published":"2026-09-22T11:10:13Z","modified":"2026-09-28T14:23:01Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T17:27:53.425914Z"}],"ghsa":[{"id":"GHSA-254q-47m3-r67w","title":"LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an...","description":"LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.","status":"published","published":"2026-09-22T12:30:25Z","modified":"2026-09-22T12:30:32Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:12:17.163357Z"}],"nvd":[{"id":"CVE-2026-63273","description":"LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.","status":"published","published":"2026-09-22T12:17:13.007Z","modified":"2026-09-22T19:09:32.273Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"DEBIAN-CVE-2026-63273","description":"LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.","status":"published","published":"2026-09-22T12:17:13.007Z","modified":"2026-09-24T20:00:06.745692808Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-63273","description":"LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.","status":"published","published":"2026-09-22T12:17:00Z","modified":"2026-10-05T19:22:30.376660416Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"MGASA-2026-0514","title":"Updated libreoffice package fixes security vulnerabilities","description":"Arbitrary file write via calcext:data-mappings, sql provider and\nFirebird backup functionality. (CVE-2026-63266)\nLFI and GET SSRF via calcext:data-mappings and csv provider.\n(CVE-2026-63267)\nLFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db\nhref. (CVE-2026-63268)\nLFI and GET SSRF via GStreamer and HLS playlists. (CVE-2026-63269)\nEnvironment/ini-file leaks. (CVE-2026-63270)\nHeap buffer overflow in WMF text record import. (CVE-2026-63272)\nHeap buffer overflow in PDF import encryption handling. (CVE-2026-63273)\nHeap buffer overflow in PDF import stream handling. (CVE-2026-63274)\nStack buffer overflow in CFF font hint handling. (CVE-2026-63275)\nStack buffer overflow in CFF to Type 1 font conversion. (CVE-2026-63276)\nRCE via calcext:data-mappings, sql provider and jdbc connector.\n(CVE-2026-63277)\nPackage URLs can be used to exfiltrate arbitrary INI file values and\nenvironment variables. (CVE-2026-63278)\nOut of bounds read in PICT image import. (CVE-2026-63279)\n","status":"published","published":"2026-10-17T03:21:49Z","modified":"2026-10-17T03:30:03.784898295Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8868-1","title":"libreoffice vulnerabilities","description":"It was discovered that LibreOffice incorrectly handled WMF image\nimports. An attacker could possibly use this issue to cause LibreOffice\nto crash, resulting in a denial of service, or execute arbitrary code.\n(CVE-2026-63272)\n\nIt was discovered that LibreOffice incorrectly handled PDF document\nimports. An attacker could possibly use this issue to cause LibreOffice\nto crash, resulting in a denial of service, or execute arbitrary code.\n(CVE-2026-63273, CVE-2026-63274)\n\nIt was discovered that LibreOffice incorrectly handled CFF fonts\nembedded in documents. An attacker could possibly use this issue to\ncause LibreOffice to crash, resulting in a denial of service, or\nexecute arbitrary code. (CVE-2026-63275, CVE-2026-63276)\n\nIt was discovered that LibreOffice incorrectly validated package URLs.\nAn attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2026-63278)\n\nIt was discovered that LibreOffice incorrectly handled PICT image\nimports. An attacker could possibly use this issue to cause LibreOffice\nto crash, resulting in a denial of service, or obtain sensitive\ninformation. (CVE-2026-63279)\n\nIt was discovered that LibreOffice incorrectly mitigated out-of-bounds\nwrites via Graphite font actions. An attacker could possibly use this\nissue to cause LibreOffice to crash, resulting in a denial of service,\nor execute arbitrary code. (CVE-2026-50593)","status":"published","published":"2026-10-05T13:14:21Z","modified":"2026-10-05T19:28:05.411753521Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}