CVE-2026-63279

What it actually does

Out-of-bounds read in PICT image import logic where an unchecked palette index is used to access memory beyond the allocated palette entries, resulting in memory corruption.

Why it matters to the business

Potential application crashes or limited information disclosure when users open documents containing specially crafted PICT images, increasing support burden and risk of workflow disruption for document-heavy operations.

How an attack unfolds

An attacker crafts a PICT image with an oversized palette index, embeds it in a document, and delivers the file to a target; when the victim opens the document in an affected LibreOffice version the unchecked index triggers the out-of-bounds read.

How to fix it

Upgrade LibreOffice to a version that enforces palette index bounds checking before use; apply vendor patches as soon as released and verify the fix is present in the installed build.

How to confirm the fix worked

Confirm the installed LibreOffice build version is newer than the vulnerable release; test import of a crafted PICT file with an out-of-range palette index and verify no crash or memory access violation occurs.

Typical attack path

1. Craft PICT image containing palette index exceeding entry count
2. Embed image in a document file
3. Deliver document via email, download, or shared storage
4. Victim opens document in vulnerable LibreOffice
5. Application performs unchecked palette lookup causing memory read outside bounds

How to detect it

Review application crash logs and memory dumps associated with PICT image import routines; correlate document open events with subsequent abnormal memory access or process termination.

What your security team should do

• Track LibreOffice release announcements for the corrective update
• Configure endpoint controls to block or sandbox untrusted document files
• Educate users to avoid opening documents from unknown sources until patched