{"id":"CVE-2026-63279","aliases":["DEBIAN-CVE-2026-63279","EUVD-2026-84358","GHSA-v5cv-mqwj-8jgx","MGASA-2026-0514","UBUNTU-CVE-2026-63279","USN-8868-1"],"status":"published","title":"Out of bounds read in PICT image import","description":"LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00154,"percentile":0.04606,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-09-22T11:10:41Z","modified":"2026-10-17T03:30:03Z","fixes":[{"ecosystem":"Debian:13","package":"libreoffice","fixed_in":["4:25.2.3-2+deb13u7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libreoffice","fixed_in":["4:26.2.5.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","fixed_in":["1:7.3.7-0ubuntu0.22.04.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","fixed_in":["4:24.2.7-0ubuntu0.24.04.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","fixed_in":["4:26.2.6.3-0ubuntu0.26.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:24.2.0-1","4:24.2.0-1~bpo12+1","4:24.2.0-2","4:24.2.0-3","4:24.2.0~alpha1-1","4:24.2.0~beta1-1","4:24.2.0~rc1-1","4:24.2.0~rc1-2","4:24.2.0~rc2-1","4:24.2.0~rc2-2","4:24.2.0~rc2-2~bpo12+1","4:24.2.1-1","4:24.2.1-2","4:24.2.1-3","4:24.2.1-4","4:24.2.1~rc1-1","4:24.2.1~rc2-1","4:24.2.2-1","4:24.2.2-2","4:24.2.2-3","4:24.2.2~rc1-1","4:24.2.2~rc1-2","4:24.2.2~rc2-1","4:24.2.2~rc2-2","4:24.2.3-1","4:24.2.3-1~bpo12+1","4:24.2.3-2","4:24.2.3~rc1-1","4:24.2.3~rc1-2","4:24.2.3~rc1-3","4:24.2.3~rc2-1","4:24.2.4-1","4:24.2.4-1~bpo12+1","4:24.2.5-1","4:24.2.5-1~bpo12+1","4:24.2.5-2","4:24.2.5-3","4:24.2.5-4","4:24.2.6-1","4:24.2.6-2","4:24.2.6-2~bpo12+1","4:24.8.0~alpha1-1","4:24.8.0~alpha1-2","4:24.8.0~alpha1-3","4:24.8.0~alpha1-4","4:24.8.0~beta1-1","4:24.8.0~rc1-1","4:24.8.0~rc2-1","4:24.8.0~rc3-1","4:24.8.0~rc3-2","4:24.8.1-1","4:24.8.1-2","4:24.8.1~rc1-1","4:24.8.2-1","4:24.8.2-1~bpo12+1","4:24.8.2-2","4:24.8.2~rc1-1","4:24.8.3-1","4:24.8.3-1~bpo12+1","4:24.8.3-2","4:24.8.3-3","4:24.8.4-1","4:24.8.4-1~bpo12+1","4:24.8.4-2","4:24.8.4-3","4:24.8.4-4","4:24.8.5-1","4:24.8.5-2","4:24.8.5-2~bpo12+1","4:24.8.5-2~bpo12+2","4:25.2.0~alpha1-1","4:25.2.0~beta1-1","4:25.2.0~beta1-2","4:25.2.0~rc1-1","4:25.2.0~rc1-2","4:25.2.0~rc1-3","4:25.2.0~rc1-4","4:25.2.0~rc2-1","4:25.2.0~rc3-1","4:25.2.0~rc3-2","4:25.2.1-1","4:25.2.1-2","4:25.2.1-3","4:25.2.1-3~bpo12+1","4:25.2.1~rc1-1","4:25.2.1~rc1-2","4:25.2.1~rc2-1","4:25.2.2-1","4:25.2.2-1~bpo12+1","4:25.2.2-2","4:25.2.2-3","4:25.2.2-3~bpo12+1","4:25.2.2~rc1-1","4:25.2.2~rc2-1","4:25.2.3-1","4:25.2.3-2","4:25.2.3-2~bpo12+1","4:25.2.3~rc1-1","4:25.2.3~rc1-2","4:25.2.3~rc2-1","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2","4:26.2.3.2-2~bpo13+1","4:26.2.4.1-1","4:26.2.4.2-1","4:26.2.4.2-1~bpo13+1","4:26.2.4.2-2","4:26.2.5.2-1","4:26.2.5.2-2","4:26.2.5.2-2~bpo13+1","4:26.8.0.0.alpha1-1","4:26.8.0.0.alpha1-2","4:26.8.0.0.alpha1-3","4:26.8.0.0.alpha1-4","4:26.8.0.0.beta1-1","4:26.8.0.1-1","4:26.8.0.2-1","4:26.8.0.3-1","4:26.8.0.3-2","4:26.8.0.3-2~bpo13+1","4:26.8.1.1-1","4:7.4.5-3","4:7.4.7-1","4:7.4.7-1+deb12u1","4:7.4.7-1+deb12u10","4:7.4.7-1+deb12u11","4:7.4.7-1+deb12u12","4:7.4.7-1+deb12u13","4:7.4.7-1+deb12u14","4:7.4.7-1+deb12u1~bpo11+1","4:7.4.7-1+deb12u2","4:7.4.7-1+deb12u2~bpo11+1","4:7.4.7-1+deb12u3","4:7.4.7-1+deb12u4","4:7.4.7-1+deb12u5","4:7.4.7-1+deb12u6","4:7.4.7-1+deb12u7","4:7.4.7-1+deb12u8","4:7.4.7-1+deb12u9","4:7.4.7-1~bpo11+1","4:7.5.0~rc2-7","4:7.5.0~rc3-1","4:7.5.1~rc1-1","4:7.5.1~rc2-1","4:7.5.2~rc1-1","4:7.5.2~rc2-1","4:7.5.3~rc1-1","4:7.5.3~rc2-1","4:7.5.4-1","4:7.5.4-2","4:7.5.4-3","4:7.5.4-4","4:7.5.4~rc1-1","4:7.5.4~rc1-2","4:7.5.4~rc1-3","4:7.5.4~rc1-4","4:7.5.4~rc2-1","4:7.5.5-1","4:7.5.5-2","4:7.5.5-3","4:7.5.5-3~bpo12+1","4:7.5.5-4","4:7.5.5-4~bpo12+1","4:7.5.5~rc1-1","4:7.5.5~rc1-2","4:7.5.5~rc1-3","4:7.5.5~rc1-4","4:7.5.5~rc1-5","4:7.5.5~rc2-1","4:7.5.6-1","4:7.5.6-1~bpo12+1","4:7.5.7-1","4:7.5.8-1","4:7.5.8-1~bpo12+1","4:7.5.8~rc1-1","4:7.5.8~rc1-2","4:7.5.9~rc1-1","4:7.5.9~rc1-1~bpo12+1","4:7.5.9~rc1-1~bpo12+2","4:7.6.0~rc1-1","4:7.6.0~rc1-2","4:7.6.0~rc2-1","4:7.6.0~rc2-2","4:7.6.0~rc3-1","4:7.6.1~rc1-1","4:7.6.1~rc2-1","4:7.6.1~rc2-2","4:7.6.2-1","4:7.6.2-2","4:7.6.2-3","4:7.6.2-4","4:7.6.2-5","4:7.6.3-1","4:7.6.3-2","4:7.6.3~rc1-1","4:7.6.3~rc1-2","4:7.6.3~rc2-1","4:7.6.3~rc2-2","4:7.6.4~rc1-1","4:7.6.4~rc1-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:25.2.3-2+deb13u7"}]}],"versions":["4:25.2.3-2","4:25.2.3-2+deb13u1","4:25.2.3-2+deb13u2","4:25.2.3-2+deb13u2~bpo12+1","4:25.2.3-2+deb13u3","4:25.2.3-2+deb13u3~bpo12+1","4:25.2.3-2+deb13u4","4:25.2.3-2+deb13u5","4:25.2.3-2+deb13u5~bpo12+1","4:25.2.3-2+deb13u6"]},{"source":"osv","ecosystem":"Debian:14","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.5.2-1"}]}],"versions":["4:25.2.3-2","4:25.8.0-1","4:25.8.0-1~bpo13+1","4:25.8.0~alpha1-1","4:25.8.0~alpha1-2","4:25.8.0~beta1-1","4:25.8.0~rc1-1","4:25.8.0~rc1-2","4:25.8.0~rc2-1","4:25.8.0~rc2-2","4:25.8.0~rc3-1","4:25.8.0~rc4-1","4:25.8.0~rc4-2","4:25.8.1-1","4:25.8.1-1~bpo13+1","4:25.8.1~rc1-1","4:25.8.2-1","4:25.8.2-2","4:25.8.2-3","4:25.8.2-3~bpo13+1","4:25.8.2~rc1-1","4:25.8.2~rc2-1","4:25.8.3-1","4:25.8.3-1+ports","4:25.8.3-1~bpo13+1","4:25.8.3~rc1-1","4:25.8.3~rc2-1","4:25.8.4-1","4:25.8.4-1~bpo13+1","4:26.2.0-1","4:26.2.0-1~bpo13+1","4:26.2.0~alpha1-1","4:26.2.0~alpha1-2","4:26.2.0~alpha1-3","4:26.2.0~beta1-1","4:26.2.0~rc1-1","4:26.2.0~rc2-1","4:26.2.0~rc3-1","4:26.2.1-1","4:26.2.1-1~bpo13+1","4:26.2.1~rc1-1","4:26.2.1~rc2-1","4:26.2.2.1-1","4:26.2.2.1-2","4:26.2.2.2-1","4:26.2.2.2-2","4:26.2.2.2-3","4:26.2.2.2-3~bpo13+1","4:26.2.3.1-1","4:26.2.3.2-1","4:26.2.3.2-2","4:26.2.3.2-2~bpo13+1","4:26.2.4.1-1","4:26.2.4.2-1","4:26.2.4.2-1~bpo13+1","4:26.2.4.2-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.6.3-1.mga10"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.3.2-0ubuntu2","1:6.3.3-0ubuntu1","1:6.3.3-0ubuntu2","1:6.3.4-0ubuntu1","1:6.4.0-0ubuntu4","1:6.4.0-0ubuntu6","1:6.4.0-0ubuntu7","1:6.4.1-0ubuntu1","1:6.4.2-0ubuntu1","1:6.4.2-0ubuntu2","1:6.4.2-0ubuntu3","1:6.4.3-0ubuntu0.20.04.1","1:6.4.4-0ubuntu0.20.04.1","1:6.4.5-0ubuntu0.20.04.1","1:6.4.6-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.1","1:6.4.7-0ubuntu0.20.04.2","1:6.4.7-0ubuntu0.20.04.4","1:6.4.7-0ubuntu0.20.04.5","1:6.4.7-0ubuntu0.20.04.6","1:6.4.7-0ubuntu0.20.04.7","1:6.4.7-0ubuntu0.20.04.8","1:6.4.7-0ubuntu0.20.04.9","1:6.4.7-0ubuntu0.20.04.10","1:6.4.7-0ubuntu0.20.04.11","1:6.4.7-0ubuntu0.20.04.12","1:6.4.7-0ubuntu0.20.04.13","1:6.4.7-0ubuntu0.20.04.14","1:6.4.7-0ubuntu0.20.04.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3.7-0ubuntu0.22.04.13"}]}],"versions":["1:7.2.1-0ubuntu3","1:7.2.2-0ubuntu0.21.10.1","1:7.2.3~rc2-0ubuntu1","1:7.2.4-0ubuntu1","1:7.2.5~rc1-0ubuntu2","1:7.2.5~rc2-0ubuntu1","1:7.3.1~rc2-0ubuntu1","1:7.3.1~rc3-0ubuntu1","1:7.3.2~rc1-0ubuntu2","1:7.3.2~rc2-0ubuntu1","1:7.3.2-0ubuntu1","1:7.3.2-0ubuntu2","1:7.3.3-0ubuntu0.22.04.1","1:7.3.4-0ubuntu0.22.04.1","1:7.3.5-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.1","1:7.3.7-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.3","1:7.3.7-0ubuntu0.22.04.4","1:7.3.7-0ubuntu0.22.04.5","1:7.3.7-0ubuntu0.22.04.6","1:7.3.7-0ubuntu0.22.04.7","1:7.3.7-0ubuntu0.22.04.8","1:7.3.7-0ubuntu0.22.04.9","1:7.3.7-0ubuntu0.22.04.10","1:7.3.7-0ubuntu0.22.04.11","1:7.3.7-0ubuntu0.22.04.12"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.2.7-0ubuntu0.24.04.7"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5","4:24.2.7-0ubuntu0.24.04.6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.6.3-0ubuntu0.26.04.2"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.2","4:26.2.5.2-0ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3.7-0ubuntu0.22.04.13"}]}],"versions":["1:7.2.1-0ubuntu3","1:7.2.2-0ubuntu0.21.10.1","1:7.2.3~rc2-0ubuntu1","1:7.2.4-0ubuntu1","1:7.2.5~rc1-0ubuntu2","1:7.2.5~rc2-0ubuntu1","1:7.3.1~rc2-0ubuntu1","1:7.3.1~rc3-0ubuntu1","1:7.3.2~rc1-0ubuntu2","1:7.3.2~rc2-0ubuntu1","1:7.3.2-0ubuntu1","1:7.3.2-0ubuntu2","1:7.3.3-0ubuntu0.22.04.1","1:7.3.4-0ubuntu0.22.04.1","1:7.3.5-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.1","1:7.3.6-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.1","1:7.3.7-0ubuntu0.22.04.2","1:7.3.7-0ubuntu0.22.04.3","1:7.3.7-0ubuntu0.22.04.4","1:7.3.7-0ubuntu0.22.04.5","1:7.3.7-0ubuntu0.22.04.6","1:7.3.7-0ubuntu0.22.04.7","1:7.3.7-0ubuntu0.22.04.8","1:7.3.7-0ubuntu0.22.04.9","1:7.3.7-0ubuntu0.22.04.10","1:7.3.7-0ubuntu0.22.04.11","1:7.3.7-0ubuntu0.22.04.12"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.2.7-0ubuntu0.24.04.7"}]}],"versions":["4:7.6.2-0ubuntu1","4:7.6.3~rc1-0ubuntu2","4:7.6.3-0ubuntu3","4:7.6.4-0ubuntu1","4:7.6.4-0ubuntu3","4:24.2.0~rc1-0ubuntu1","4:24.2.1~rc1-0ubuntu1","4:24.2.1~rc2-0ubuntu1","4:24.2.2~rc2-0ubuntu1","4:24.2.2-0ubuntu1","4:24.2.3-0ubuntu0.24.04.1","4:24.2.3-0ubuntu0.24.04.2","4:24.2.4-0ubuntu0.24.04.1","4:24.2.4-0ubuntu0.24.04.2","4:24.2.5-0ubuntu0.24.04.1","4:24.2.5-0ubuntu0.24.04.2","4:24.2.6-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.1","4:24.2.7-0ubuntu0.24.04.2","4:24.2.7-0ubuntu0.24.04.3","4:24.2.7-0ubuntu0.24.04.4","4:24.2.7-0ubuntu0.24.04.5","4:24.2.7-0ubuntu0.24.04.6"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.6.3-0ubuntu0.26.04.2"}]}],"versions":["4:25.8.1~rc1-0ubuntu1","4:25.8.3-0ubuntu1","4:25.8.4~rc1-0ubuntu2","4:25.8.4~rc1-0ubuntu3","4:25.8.4~rc2-0ubuntu1","4:26.2.1~rc2-0ubuntu1","4:26.2.2.2-0ubuntu1","4:26.2.3.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.1","4:26.2.4.2-0ubuntu0.26.04.2","4:26.2.5.2-0ubuntu0.26.04.1"],"bundled":8}],"products":[{"vendor":"the document foundation","product":"libreoffice"}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-63279","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63279"},{"url":"https://github.com/advisories/GHSA-v5cv-mqwj-8jgx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63279","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0514.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36383","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00424.html","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63272","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63273","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63274","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63275","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63276","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63277","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63278","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63279","tags":["web","report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00457.html","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63266","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63267","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63268","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63269","tags":["web"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63270","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8868-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63279","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-50593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63278","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-63279","title":"Out of bounds read in PICT image import","description":"LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.","status":"published","published":"2026-09-22T11:10:41.707Z","modified":"2026-09-22T12:16:55.755Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:19:55.914391Z"}],"euvd":[{"id":"EUVD-2026-84358","description":"LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.","status":"published","published":"2026-09-22T11:10:41Z","modified":"2026-09-22T12:16:55Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T17:28:03.363938Z"}],"ghsa":[{"id":"GHSA-v5cv-mqwj-8jgx","title":"LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read...","description":"LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.","status":"published","published":"2026-09-22T12:30:26Z","modified":"2026-09-22T12:30:32Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:12:17.163357Z"}],"nvd":[{"id":"CVE-2026-63279","description":"LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.","status":"published","published":"2026-09-22T12:17:13.85Z","modified":"2026-09-22T19:09:32.273Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"DEBIAN-CVE-2026-63279","description":"LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.","status":"published","published":"2026-09-22T12:17:13.85Z","modified":"2026-09-24T20:00:06.729712716Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-63279","description":"LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.","status":"published","published":"2026-09-22T12:17:00Z","modified":"2026-10-05T19:22:29.97309393Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"MGASA-2026-0514","title":"Updated libreoffice package fixes security vulnerabilities","description":"Arbitrary file write via calcext:data-mappings, sql provider and\nFirebird backup functionality. (CVE-2026-63266)\nLFI and GET SSRF via calcext:data-mappings and csv provider.\n(CVE-2026-63267)\nLFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db\nhref. (CVE-2026-63268)\nLFI and GET SSRF via GStreamer and HLS playlists. (CVE-2026-63269)\nEnvironment/ini-file leaks. (CVE-2026-63270)\nHeap buffer overflow in WMF text record import. (CVE-2026-63272)\nHeap buffer overflow in PDF import encryption handling. (CVE-2026-63273)\nHeap buffer overflow in PDF import stream handling. (CVE-2026-63274)\nStack buffer overflow in CFF font hint handling. (CVE-2026-63275)\nStack buffer overflow in CFF to Type 1 font conversion. (CVE-2026-63276)\nRCE via calcext:data-mappings, sql provider and jdbc connector.\n(CVE-2026-63277)\nPackage URLs can be used to exfiltrate arbitrary INI file values and\nenvironment variables. (CVE-2026-63278)\nOut of bounds read in PICT image import. (CVE-2026-63279)\n","status":"published","published":"2026-10-17T03:21:49Z","modified":"2026-10-17T03:30:03.784898295Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8868-1","title":"libreoffice vulnerabilities","description":"It was discovered that LibreOffice incorrectly handled WMF image\nimports. An attacker could possibly use this issue to cause LibreOffice\nto crash, resulting in a denial of service, or execute arbitrary code.\n(CVE-2026-63272)\n\nIt was discovered that LibreOffice incorrectly handled PDF document\nimports. An attacker could possibly use this issue to cause LibreOffice\nto crash, resulting in a denial of service, or execute arbitrary code.\n(CVE-2026-63273, CVE-2026-63274)\n\nIt was discovered that LibreOffice incorrectly handled CFF fonts\nembedded in documents. An attacker could possibly use this issue to\ncause LibreOffice to crash, resulting in a denial of service, or\nexecute arbitrary code. (CVE-2026-63275, CVE-2026-63276)\n\nIt was discovered that LibreOffice incorrectly validated package URLs.\nAn attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2026-63278)\n\nIt was discovered that LibreOffice incorrectly handled PICT image\nimports. An attacker could possibly use this issue to cause LibreOffice\nto crash, resulting in a denial of service, or obtain sensitive\ninformation. (CVE-2026-63279)\n\nIt was discovered that LibreOffice incorrectly mitigated out-of-bounds\nwrites via Graphite font actions. An attacker could possibly use this\nissue to cause LibreOffice to crash, resulting in a denial of service,\nor execute arbitrary code. (CVE-2026-50593)","status":"published","published":"2026-10-05T13:14:21Z","modified":"2026-10-05T19:28:05.411753521Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}