CVE-2026-63279
published 2026-09-22CVE-2026-63279: LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The…
PriorityP423medium5.4CVSS 4.0
AVLACLATNPRNUIPVCLVINVAHSCNSINSANEPCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.15%
4.2th percentile
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| the_document_foundation | libreoffice | >= 26.2 < < 26.2.5 | < 26.2.5 |
| ubuntu | libreoffice | — | — |
CVSS provenance
nvdv4.05.4MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_ubuntu7.3HIGH
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
LibreOffice vulnerabilities
vendor_ubuntu·2026-10-05·CVSS 7.3
CVE-2026-50593 [HIGH] LibreOffice vulnerabilities
Title: LibreOffice vulnerabilities
Summary: Several security issues were fixed in LibreOffice.
It was discovered that LibreOffice incorrectly handled WMF image
imports. An attacker could possibly use this issue to cause LibreOffice
to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2026-63272)
It was discovered that LibreOffice incorrectly handled PDF document
imports. An attacker could possibly use this issue to cause LibreOffice
to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2026-63273, CVE-2026-63274)
It was discovered that LibreOffice incorrectly handled CFF fonts
embedded in documents. An attacker could possibly use this issue to
cause LibreOffice to crash, resulting in a denial of service, or
execute arbitrary code. (CVE-2026-
Red Hat
libreoffice: LibreOffice: Information disclosure and denial of service via out-of-bounds read in PICT image import
vendor_redhat·2026-09-22·CVSS 5.4
CVE-2026-63279 [MEDIUM] CWE-125 libreoffice: LibreOffice: Information disclosure and denial of service via out-of-bounds read in PICT image import
libreoffice: LibreOffice: Information disclosure and denial of service via out-of-bounds read in PICT image import
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.
A flaw was found in LibreOffice. When importing a specially crafted PICT image embedded in a document, an out-of-bounds read vulnerability exists. This occurs because the palette index in the image data is not validated against the actual size of the color palette. A remote
GHSA
LibreOffice can import PICT images, which may be embedded in documents.
ghsa_unreviewed·2026-09-22
CVE-2026-63279 [MEDIUM] CWE-125 LibreOffice can import PICT images, which may be embedded in documents.
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-22
Published