CVE-2026-63274: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-63274 is a heap buffer overflow vulnerability in LibreOffice Draw's PDF import functionality. When importing a PDF stream object, the declared stream length is read from the object's own dictionary without being validated against the number of bytes actually present, causing the copy operation to read and write past the end of the allocated buffer. The vulnerability affects LibreOffice versions in the 26.2 series prior to 26.2.5, developed by The Document Foundation. It carries a CVSS v4.0 base score of 5.4 (Medium), though the potential impact of exploitation could include arbitrary code execution (GitHub Advisory, LibreOffice Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write), arising from missing bounds validation in LibreOffice Draw's PDF stream object parser. When a crafted PDF provides a stream length value in its dictionary that exceeds the actual bytes present in the file, the stream copy routine uses the attacker-controlled length rather than the real byte count, resulting in a heap buffer overread and overwrite. Exploitation requires a user to open a specially crafted PDF file in LibreOffice Draw (passive user interaction), but no special privileges are required. In fixed versions, the declared stream length is clamped to the number of bytes actually read, preventing the out-of-bounds operation (GitHub Advisory, LibreOffice Advisory).

Successful exploitation of this vulnerability can lead to heap memory corruption, potentially enabling arbitrary code execution with the privileges of the user running LibreOffice Draw. The confidentiality and integrity impacts on the vulnerable system are rated low, while availability impact is rated high, reflecting the risk of application crash or controlled memory corruption. If code execution is achieved, an attacker could access sensitive documents, install malware, or pivot to other resources accessible to the compromised user account (GitHub Advisory).

As of the disclosure date (September 22, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The CVSS v4.0 exploit maturity is rated "Proof of Concept," though no PoC has been publicly confirmed. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory, LibreOffice Advisory).

1. Craft a malicious PDF: Create a PDF file containing a stream object whose dictionary declares a Length value significantly larger than the actual number of bytes present in the stream body.
2. Deliver the file: Distribute the crafted PDF to a target user via email attachment, download link, or other social engineering means, targeting users with LibreOffice 26.2.x (prior to 26.2.5) installed.
3. Trigger the import: Induce the victim to open the PDF in LibreOffice Draw (e.g., by double-clicking the file or using File > Open). LibreOffice Draw will attempt to parse and import the PDF stream object.
4. Trigger heap overflow: The PDF parser reads the attacker-controlled Length from the stream dictionary and uses it to copy stream data, reading and writing beyond the allocated heap buffer.
5. Achieve code execution or crash: Depending on heap layout and exploit precision, the out-of-bounds write may overwrite adjacent heap metadata or function pointers, potentially enabling arbitrary code execution at the privilege level of the victim user, or causing a denial-of-service crash (GitHub Advisory, LibreOffice Advisory).

• File System: Presence of unexpected or unsolicited PDF files in user download directories or email attachments; PDF files with anomalously large declared stream Length values relative to actual file size.
• Process: LibreOffice Draw (soffice, soffice.bin) spawning unexpected child processes (e.g., shells, scripting interpreters, network utilities such as curl, wget, bash, cmd.exe, powershell.exe).
• Logs: Application crash logs or core dumps associated with LibreOffice Draw processes; operating system crash reports referencing heap corruption in LibreOffice modules.
• Network: Unexpected outbound network connections originating from the LibreOffice process to unknown external IP addresses following the opening of a PDF file.

The vulnerability is fixed in LibreOffice 26.2.5, where the declared stream length is clamped to the number of bytes actually read during PDF import. Users should upgrade to LibreOffice 26.2.5 or later as the primary remediation. Until patching is possible, users should avoid opening PDF files from untrusted or unknown sources in LibreOffice Draw, and consider using an alternative PDF viewer for untrusted content (LibreOffice Advisory, GitHub Advisory).