Cloudanix VulnDB

CVE-2026-63274

None

CVSS

—

EPSS

0.2%

Published

Sep 22, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

LibreOffice Draw may crash or act strangely when opening certain PDF files so install the available software update to prevent problems.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Heap buffer overflow during PDF stream object import in LibreOffice Draw where declared stream length from dictionary is used without validation against actual bytes present, causing out-of-bounds read and write.

Why it matters to the business

Potential application crashes or arbitrary code execution when users open crafted PDFs disrupts document workflows on Red Hat Enterprise Linux systems; 41 days since disclosure increases exposure window for unpatched installations.

How an attack unfolds

An attacker creates a PDF containing a stream object whose dictionary declares a length exceeding the actual data bytes. When the victim opens the document in LibreOffice Draw the import routine copies the declared length without bounds checking, triggering the overflow.

How to fix it

Upgrade libreoffice on Red Hat Enterprise Linux 9 to version 7.1.8.1-15.el9_8.3 via RHSA-2026:82013.

How to confirm the fix worked

Confirm package version meets or exceeds the fixed release and test PDF import of documents containing stream objects with varying declared versus actual lengths.

Typical attack path

  1. Craft malicious PDF embedding stream object with inflated length declaration
  2. Deliver PDF via email, web download or shared storage
  3. Victim opens PDF using LibreOffice Draw
  4. Overflow occurs during stream import allowing memory corruption

How to detect it

Review application and system logs for segmentation faults or heap-related errors during PDF import operations and correlate with user activity involving untrusted documents.

What your security team should do

  • Apply the Red Hat advisory update immediately on all affected systems
  • Restrict LibreOffice Draw PDF import to trusted sources until patched
  • Monitor vulnerability disclosure feeds for any exploit maturity changes

The record

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities