The Document Foundation Libreoffice vulnerabilities

CVE-2020-12802 [MEDIUM] CWE-200 CVE-2020-12802: LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote graphic links loaded from docx documents

CVE-2026-63266 [MEDIUM] CWE-22 CVE-2026-63266: LibreOffice Calc can link a cell range to an external data source, and the link is saved in the docu LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.

CVE-2026-63268 [MEDIUM] CWE-200 CVE-2026-63268: LibreOffice Calc can link a cell range to an external data source, and the link is saved in the docu LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.

CVE-2020-12801 [MEDIUM] CWE-311 CVE-2020-12801: If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the file format of the recovered document was not LibreOffice's default ODF file format, then affected versions of L

CVE-2026-63276 [MEDIUM] CWE-787 CVE-2026-63276: LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is ex LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote pa

CVE-2026-63267 [MEDIUM] CWE-200 CVE-2026-63267: LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link upd

CVE-2026-63269 [MEDIUM] CWE-200 CVE-2026-63269: LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStre LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists t

CVE-2026-6045 [MEDIUM] CWE-190 CVE-2026-6045: LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow exi LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and then filled as if it were large, w

CVE-2026-6047 [MEDIUM] CWE-787 CVE-2026-6047: LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when rep LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the

CVE-2026-63272 [MEDIUM] CWE-125 CVE-2026-63272: LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow exis LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by c

CVE-2026-63274 [MEDIUM] CWE-125 CVE-2026-63274: LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream ob LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared leng

CVE-2026-63275 [MEDIUM] CWE-787 CVE-2026-63275: LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really ha

CVE-2025-2866 [MEDIUM] CWE-347 CVE-2025-2866: Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature S Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6,

CVE-2026-6039 [MEDIUM] CWE-197 CVE-2026-6039: LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow exist LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a polyline whose point count exceeded the 16-bit range was written past t

CVE-2026-63279 [MEDIUM] CWE-125 CVE-2026-63279: LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existe LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed vers

CVE-2026-63273 [MEDIUM] CWE-787 CVE-2026-63273: LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypte LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versio

CVE-2026-8358 [MEDIUM] CWE-787 CVE-2026-8358: LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow exis LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identif

CVE-2024-12425 [LOW] CWE-22 CVE-2024-12425: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 befo