Cloudanix VulnDB

CVE-2026-63276

None

CVSS

—

EPSS

0.2%

Published

Sep 22, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in document software can let attackers crash the program or run harmful code when a user exports a file containing certain fonts to PDF.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Stack buffer overflow in CFF-to-Type-1 font conversion during PDF export allows writes past a fixed-size buffer when a glyph emits many operators.

Why it matters to the business

Users opening or exporting documents containing embedded CFF fonts risk application crashes or potential code execution, which can disrupt document workflows and require urgent patching on affected systems.

How an attack unfolds

An attacker embeds a specially crafted CFF font in a document; when a victim opens the document and triggers PDF export (or font subsetting), the conversion routine overflows the stack buffer, potentially leading to control-flow hijacking.

How to fix it

Upgrade LibreOffice to the fixed version provided by your distribution (for Red Hat Enterprise Linux 9: 7.1.8.1-15.el9_8.3 via RHSA-2026:82013). Rebuild or reinstall any affected packages and verify the new version reports the corrected font-handling code.

How to confirm the fix worked

Confirm installed package version matches or exceeds the fixed release, then test PDF export with documents containing CFF fonts to ensure no crashes or malformed output occur.

Typical attack path

  1. Craft malicious document containing oversized CFF font operators
  2. Deliver document via email, download, or shared storage
  3. Victim opens document in vulnerable LibreOffice
  4. Victim initiates PDF export or font embedding operation
  5. Conversion routine writes beyond buffer, enabling arbitrary code execution or crash

How to detect it

Search application and system logs for LibreOffice segmentation faults or abnormal exits during PDF export operations; correlate with recent document file access timestamps.

What your security team should do

  • Apply the vendor-supplied update immediately on all systems running the affected LibreOffice packages
  • Disable or restrict PDF export workflows for untrusted documents until patches are deployed
  • Monitor for LibreOffice process crashes during document handling as a potential exploitation signal
  • Review and harden document handling policies to reduce exposure to untrusted files

The record

LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities