CVE-2026-63269: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-63269 is an information disclosure vulnerability in LibreOffice on Linux, where a maliciously crafted document containing a linked HLS (HTTP Live Streaming) media playlist can cause GStreamer to read local files and remote URLs, potentially exposing their contents within the document. It affects LibreOffice versions in the 26.2 series prior to 26.2.5, developed by The Document Foundation. The vulnerability was published on October 5, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.7 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause lies in LibreOffice's handling of linked media files on Linux, where GStreamer is used to play audio and video content embedded in documents (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor; CWE-918: Server-Side Request Forgery; CWE-73: External Control of File Name or Path). An attacker crafts a document that links to an HLS playlist file; when the document is opened, GStreamer automatically processes the playlist and fetches all resources listed within it — including local filesystem paths and remote URLs — without adequate restriction or user consent. The fetched content can then be embedded back into the document, enabling exfiltration of sensitive local files or internal network resources. Exploitation requires user interaction (opening the malicious document) but no special privileges (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a high confidentiality impact, allowing an attacker to read arbitrary local files accessible to the user running LibreOffice, as well as probe internal network resources via SSRF through GStreamer's URL fetching. There is no integrity or availability impact. The exposed data could include sensitive configuration files, credentials, SSH keys, or other user-accessible documents, and the SSRF component could be leveraged to map internal network services (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The CVE status is listed as "Deferred" and the EPSS score is approximately 0.109%, placing it in the 1st percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported. Exploitation is limited to Linux systems where GStreamer is used by LibreOffice for media playback.

1. Craft a malicious HLS playlist: Create an .m3u8 HLS playlist file that references target local files (e.g., file:///etc/passwd, file:///home/user/.ssh/id_rsa) and/or internal network URLs as media segments.
2. Host the playlist: Place the HLS playlist on an attacker-controlled web server or embed it as a local file reference within the document.
3. Create a malicious LibreOffice document: Craft a LibreOffice document (e.g., .odt, .odp) that contains a linked media object pointing to the attacker-controlled HLS playlist URL or file path.
4. Deliver the document: Send the malicious document to the target via email, file sharing, or other social engineering means, enticing the victim to open it on a Linux system running a vulnerable LibreOffice version (26.2 < 26.2.5).
5. Trigger automatic media loading: When the victim opens the document, LibreOffice automatically processes the linked media, causing GStreamer to fetch and read all resources listed in the HLS playlist — including local files and remote URLs.
6. Exfiltrate data: The contents of the fetched files are embedded into the document or transmitted to attacker-controlled remote URLs listed in the playlist, completing the data exfiltration (GitHub Advisory, Red Hat Bugzilla).

• Network: Unexpected outbound HTTP/HTTPS requests from a LibreOffice process (e.g., soffice) to external or internal IP addresses, particularly fetching .m3u8 or .ts (MPEG-TS) files; GStreamer-initiated connections to unusual remote hosts during document open events.
• File System: Presence of suspicious .odt, .odp, or other LibreOffice document files containing embedded media links pointing to file:// URIs or external HLS playlist URLs; unexpected access to sensitive files (e.g., /etc/passwd, ~/.ssh/) by the LibreOffice process.
• Logs: System audit logs (auditd) showing soffice or GStreamer (gst-launch) processes opening sensitive local files; network proxy or firewall logs recording unusual outbound requests from workstations during office document open events.
• Process: GStreamer helper processes (gst-plugin-scanner, gst-launch-1.0) spawned as children of LibreOffice (soffice.bin) while opening a document, particularly when no media playback is expected.

Update LibreOffice to version 26.2.5 or later, which prevents following HLS playlists that reference further resources and places linked media under link update control (GitHub Advisory, LibreOffice Advisory). As a temporary workaround, disable automatic link updates in LibreOffice settings (Tools → Options → LibreOffice → Security → Macro Security / Links) to prevent automatic processing of media files when documents are opened. Additionally, avoid opening LibreOffice documents from untrusted sources on Linux systems until the patch is applied.

Heise Online reported on the vulnerability in the context of broader LibreOffice security updates, noting warnings about code-smuggling vulnerabilities (Heise Online). Security aggregators including SecurityOnline.info and BeyondMachines.net covered the LibreOffice patch release, grouping CVE-2026-63269 alongside other vulnerabilities fixed in the same update cycle. Community reaction has been moderate given the Medium severity rating and Linux-only scope, with no significant controversy or widespread alarm noted.