Cloudanix VulnDB

CVE-2026-63275

None

CVSS

—

EPSS

0.2%

Published

Sep 22, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A problem in document software can let specially made files cause crashes or run unwanted code when opened.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Stack buffer overflow in CFF font hint parsing where glyph hint count is validated against an incorrect bound, enabling writes beyond the allocated array when processing embedded fonts in documents.

Why it matters to the business

Risk of application crashes or limited code execution when users open untrusted documents, potentially disrupting document workflows in environments using LibreOffice on Red Hat systems; remediation deadline not enforced via KEV but patch available since publication 41 days ago.

How an attack unfolds

An attacker embeds a specially crafted CFF font containing a glyph that declares more hints than the internal array supports into a document; when a victim opens the file in an affected LibreOffice version the incorrect bound check allows the overflow to occur during font loading.

How to fix it

Upgrade LibreOffice on Red Hat Enterprise Linux 9 to version 7.1.8.1-15.el9_8.3 as provided in RHSA-2026:82013; verify the update via package manager and restart affected applications.

How to confirm the fix worked

Confirm the installed LibreOffice package version matches or exceeds the fixed release; attempt to open a test document containing a CFF font with high hint counts to verify the overflow no longer occurs.

Typical attack path

  1. Create a document containing an embedded CFF font with a glyph declaring excessive hint values
  2. Distribute the malicious document via email, download, or shared storage
  3. Victim opens the document in vulnerable LibreOffice
  4. Font parser performs out-of-bounds write during hint processing, leading to crash or limited code execution

How to detect it

Review system and application logs for LibreOffice crashes during font or document parsing; inspect recently received documents for embedded CFF fonts and correlate with user-reported instability.

What your security team should do

  • Immediately apply the Red Hat advisory update to all affected systems
  • Restrict opening of untrusted documents until patches are deployed
  • Monitor vulnerability feeds for any change in exploit maturity or KEV inclusion

The record

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities