CVE-2026-63275: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-63275 is a stack buffer overflow vulnerability in LibreOffice's CFF (Compact Font Format) font parsing engine, allowing potential arbitrary code execution when a user opens a malicious document containing a specially crafted embedded CFF font. The flaw exists because the number of hints in a glyph is validated against an incorrect bound, allowing writes past the end of the allocated array. It affects LibreOffice versions in the 26.2 series prior to 26.2.5, developed by The Document Foundation. The vulnerability was published on September 22, 2026, and carries a CVSS v4.0 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write): when LibreOffice parses CFF fonts embedded in documents, it reads the hint count for each glyph and validates it against an incorrect upper bound, rather than the actual capacity of the stack-allocated array. A maliciously crafted CFF font can declare more hints than the array can hold, causing the parser to write beyond the array's end on the stack. Exploitation requires a user to open a document (passive user interaction), but no special privileges or network access are needed — the attack vector is local (file-based). Fixed versions correct the validation by checking the hint count against the true array capacity (GitHub Advisory).

Successful exploitation can result in arbitrary code execution with the privileges of the LibreOffice process, as well as potential crashes (high availability impact). The vulnerable system may also experience limited confidentiality and integrity compromise (both rated Low in CVSS v4.0). Subsequent systems are not directly impacted by the vulnerability itself, though code execution in the user's context could enable further lateral movement or data exfiltration depending on the environment (GitHub Advisory).

As of the disclosure date, there is no evidence of active in-the-wild exploitation, and no public proof-of-concept exploit has been confirmed — though the CVSS v4.0 exploit maturity is listed as "Proof of Concept" in the scoring vector. The EPSS score is 0.0, indicating a very low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires passive user interaction (opening a malicious document) (GitHub Advisory).

1. Craft malicious document: Create a document (e.g., ODT, DOCX, or PDF) that embeds a specially crafted CFF font. The font must contain a glyph whose hint count exceeds the capacity of the stack-allocated hints array in LibreOffice's CFF parser.
2. Deliver the document: Distribute the malicious document to the target via email attachment, file share, download link, or other social engineering vector, targeting users running LibreOffice 26.2.x prior to 26.2.5.
3. Trigger font parsing: When the victim opens the document in LibreOffice, the application parses the embedded CFF font and reads the glyph's hint count, which is validated against the wrong bound.
4. Trigger stack buffer overflow: The parser writes hint data past the end of the stack array, corrupting adjacent stack memory (return addresses, saved registers, or other local variables).
5. Achieve code execution: With sufficient control over the overwritten stack data (e.g., via ROP chain or direct return address overwrite), an attacker can redirect execution to attacker-controlled code, running arbitrary commands with the privileges of the LibreOffice process (GitHub Advisory).

• File System: Unexpected or newly created files in the user's home directory or temp folders (e.g., /tmp/, %TEMP%) shortly after opening a document; suspicious scripts or executables dropped by the LibreOffice process.
• Process: Unusual child processes spawned by LibreOffice (e.g., soffice.bin, soffice) such as shells (bash, cmd.exe, powershell.exe), network utilities (curl, wget), or other unexpected executables.
• Logs: Application crash logs or core dumps associated with LibreOffice CFF font rendering; OS-level crash reports referencing stack corruption in LibreOffice font parsing modules.
• Network: Unexpected outbound network connections originating from the LibreOffice process to external IP addresses, particularly shortly after document opening.

The Document Foundation has released LibreOffice 26.2.5, which fixes the vulnerability by correctly validating the CFF glyph hint count against the actual array capacity. Users should update to version 26.2.5 or later as the primary remediation. As interim workarounds, avoid opening documents from untrusted or unknown sources, particularly those that may contain embedded fonts. Organizations may also consider sandboxing LibreOffice (e.g., using AppArmor, SELinux, or container-based isolation) to limit the impact of potential exploitation (GitHub Advisory, LibreOffice Advisory).