Cloudanix VulnDB

CVE-2026-63272

None

CVSS

—

EPSS

0.2%

Published

Sep 22, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how documents with certain graphics are opened can let an attacker crash the program or run code when a user opens a specially made file.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Heap buffer overflow during WMF text record import when the count of character advance widths is smaller than the text length, causing out-of-bounds reads while walking the advance array by character position.

Why it matters to the business

Opening a malicious document can crash the application or allow limited local code execution, disrupting document workflows and requiring urgent patching across user systems.

How an attack unfolds

An attacker creates a WMF graphic containing a text record whose advance-width count is deliberately shorter than the text length, embeds it in a document, and delivers the file to a target. When LibreOffice imports the graphic the mismatched lengths cause the overflow during text drawing.

How to fix it

Upgrade LibreOffice to a version that ignores an advance array shorter than its associated text; monitor vendor advisories for the exact fixed releases applicable to each branch.

How to confirm the fix worked

Confirm the installed LibreOffice version matches or exceeds the vendor's fixed release; attempt to open a test document containing a short-advance WMF record and verify the application no longer crashes or exhibits memory corruption.

Typical attack path

  1. Craft WMF text record with advance array shorter than text length
  2. Embed the WMF inside a document file
  3. Deliver the document to the victim via email or download
  4. Victim opens the document in an unpatched LibreOffice instance
  5. Import routine triggers the heap overflow while rendering the text

How to detect it

Review application crash logs and memory dumps for heap-buffer violations during WMF import; correlate document-open events with subsequent process instability or unusual memory access patterns.

What your security team should do

  • Immediately update all LibreOffice installations to the latest fixed versions
  • Block or sandbox receipt of documents containing WMF graphics until patches are deployed
  • Add the vulnerability to the organization's patch-management priority list given the 41-day public disclosure window

The record

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities