CVE-2026-63274
published 2026-09-22CVE-2026-63274: LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's…
PriorityP424medium5.4CVSS 4.0
AVLACLATNPRNUIPVCLVILVAHSCNSINSANEPCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.19%
7.8th percentile
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libreoffice | libreoffice | — | — |
| the_document_foundation | libreoffice | >= 26.2 < < 26.2.5 | < 26.2.5 |
| ubuntu | libreoffice | — | — |
CVSS provenance
nvdv4.05.4MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_ubuntu7.3HIGH
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
LibreOffice vulnerabilities
vendor_ubuntu·2026-10-05·CVSS 7.3
CVE-2026-50593 [HIGH] LibreOffice vulnerabilities
Title: LibreOffice vulnerabilities
Summary: Several security issues were fixed in LibreOffice.
It was discovered that LibreOffice incorrectly handled WMF image
imports. An attacker could possibly use this issue to cause LibreOffice
to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2026-63272)
It was discovered that LibreOffice incorrectly handled PDF document
imports. An attacker could possibly use this issue to cause LibreOffice
to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2026-63273, CVE-2026-63274)
It was discovered that LibreOffice incorrectly handled CFF fonts
embedded in documents. An attacker could possibly use this issue to
cause LibreOffice to crash, resulting in a denial of service, or
execute arbitrary code. (CVE-2026-
Red Hat
libreoffice: heap buffer overflow in PDF import stream handling
vendor_redhat·2026-09-22·CVSS 5.4
CVE-2026-63274 [MEDIUM] CWE-120 libreoffice: heap buffer overflow in PDF import stream handling
libreoffice: heap buffer overflow in PDF import stream handling
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
A flaw was found in LibreOffice. When a user imports a specially crafted PDF document with LibreOffice Draw, a heap-based buffer overflow can occur due to improper validation of the stream length. This issue can cause memory corruption, resulting in an application crash.
Statement: To exploit this issue, an attacker needs to convince a us
VulDB
Document Foundation LibreOffice up to 26.2.4 PDF Import heap-based overflow (EUVD-2026-84354 / Nessus ID 365560)
vuldb·2026-10-14·CVSS 5.4
CVE-2026-63274 [MEDIUM] Document Foundation LibreOffice up to 26.2.4 PDF Import heap-based overflow (EUVD-2026-84354 / Nessus ID 365560)
A vulnerability, which was classified as critical, has been found in Document Foundation LibreOffice up to 26.2.4. Affected by this issue is some unknown functionality of the component PDF Import. This manipulation causes heap-based buffer overflow.
The identification of this vulnerability is CVE-2026-63274. It is possible to initiate the attack remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
LibreOffice Draw can import PDF documents.
ghsa_unreviewed·2026-09-22
CVE-2026-63274 [MEDIUM] CWE-125 LibreOffice Draw can import PDF documents.
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-63274 libreoffice: heap buffer overflow in PDF import stream handling [fedora-all]
bugzilla·2026-09-24·CVSS 5.4
CVE-2026-63274 [MEDIUM] CVE-2026-63274 libreoffice: heap buffer overflow in PDF import stream handling [fedora-all]
CVE-2026-63274 libreoffice: heap buffer overflow in PDF import stream handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
Bugzilla
CVE-2026-63274 libreoffice: heap buffer overflow in PDF import stream handling
bugzilla·2026-09-22·CVSS 5.4
CVE-2026-63274 [MEDIUM] CVE-2026-63274 libreoffice: heap buffer overflow in PDF import stream handling
CVE-2026-63274 libreoffice: heap buffer overflow in PDF import stream handling
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
2026-09-22
Published