CVE-2026-63279: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-63279 is an out-of-bounds read vulnerability in LibreOffice's PICT image import functionality, allowing information disclosure and denial of service when processing maliciously crafted images with color palettes. The flaw affects LibreOffice versions in the 26.2 series prior to 26.2.5, developed by The Document Foundation. It was published on September 22, 2026, with a patch available in version 26.2.5. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds read (CWE-125) in LibreOffice's PICT image parser. When importing a PICT image that uses a color palette, the palette index embedded in the image data is consumed directly without being validated against the actual number of entries in the palette. An index exceeding the palette's bounds causes the parser to read memory adjacent to the palette buffer. In fixed versions (26.2.5+), the palette index is clamped to the valid range of entries present in the palette (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in two primary consequences: limited disclosure of memory contents adjacent to the palette buffer (confidentiality impact) and a potential application crash or denial of service (high availability impact). An attacker who tricks a user into opening a crafted document containing a malicious PICT image could cause LibreOffice to read out-of-bounds memory, potentially leaking sensitive in-process data or crashing the application. There is no integrity impact, and the scope is limited to the vulnerable LibreOffice process without lateral movement potential (GitHub Advisory, Red Hat Bugzilla).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The CVSS v4.0 exploit maturity is rated "Proof of Concept," though no actual PoC has been publicly released. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must open a specially crafted document or PICT image file.

1. Craft malicious PICT image: Create a PICT image file that declares a color palette with a small number of entries but embeds image data referencing palette indices beyond the declared palette size.
2. Embed in document: Optionally embed the crafted PICT image within a LibreOffice-compatible document format (e.g., ODT, DOC) to increase the likelihood of the victim opening it.
3. Deliver to target: Send the crafted file to the victim via email attachment, file share, or download link, relying on social engineering to prompt the user to open it.
4. Trigger out-of-bounds read: When the victim opens the document in a vulnerable LibreOffice version (26.2 series < 26.2.5), the PICT image importer reads the invalid palette index without bounds checking, accessing memory outside the palette buffer.
5. Achieve impact: Depending on memory layout, the out-of-bounds read may cause LibreOffice to crash (denial of service) or expose adjacent memory contents that could be leveraged for further information disclosure (GitHub Advisory, Red Hat Bugzilla).

• File System: Presence of unexpected or unsolicited PICT image files (.pict, .pic) or documents embedding PICT images received from unknown sources.
• Logs: LibreOffice crash reports or core dump files generated after opening a document containing a PICT image; application error logs referencing memory access violations during image import.
• Process: Unexpected termination (crash) of the LibreOffice process (soffice, soffice.bin) immediately after opening a document; abnormal memory access errors reported by the OS or crash handler.

Update LibreOffice to version 26.2.5 or later, which limits palette indices to the valid range of entries present in the palette (GitHub Advisory). As a temporary workaround until patching is feasible, restrict or disable the import of PICT image files from untrusted sources, and avoid opening documents from unknown or untrusted senders. Organizations should prioritize patching given that user interaction (opening a file) is the only prerequisite for exploitation.