Cloudanix VulnDB

CVE-2026-63273

None

CVSS

—

EPSS

0.1%

Published

Sep 22, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how a common office program reads certain protected PDF files could let an attacker crash the program or run unwanted code when a user opens a specially made document.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Heap buffer overflow occurs when LibreOffice Draw imports an encrypted PDF: the decryption key length is read from the document's encryption dictionary and copied into a fixed-size buffer without bounds checking, allowing writes past the buffer end.

Why it matters to the business

Opening a crafted PDF can crash the application or allow limited local code execution, risking document theft, system instability, or follow-on attacks on user workstations.

How an attack unfolds

An attacker prepares a PDF with an oversized key-length value in its encryption dictionary, then delivers the file to a target who opens it with LibreOffice Draw; the unchecked length triggers the overflow during import.

How to fix it

Upgrade LibreOffice to a version that rejects encryption dictionaries declaring a key length larger than the fixed buffer; disable PDF import if patching is not feasible.

How to confirm the fix worked

Confirm the installed LibreOffice version contains the key-length check; attempt import of a test PDF with an oversized key length and verify the application rejects it without crashing.

Typical attack path

  1. Create malicious PDF embedding an encryption dictionary declaring an excessively long key
  2. Deliver the file via email, download link, or shared storage
  3. Victim opens the document in LibreOffice Draw
  4. Overflow writes attacker-controlled data past the key buffer during decryption setup

How to detect it

Review application crash logs and process dumps for LibreOffice Draw around the time a user opened an encrypted PDF; correlate with file-access timestamps of recently received PDF documents.

What your security team should do

  • Prioritize patching LibreOffice on all endpoints that handle untrusted PDFs within 30 days
  • Add PDF import from external sources to the list of high-risk actions requiring extra scrutiny
  • Monitor vendor release notes for the exact fixed build numbers and push updates via existing software-distribution channels

The record

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities