CVE-2026-63274: CWE-787 Out-of-bounds Write in The Document Foundation LibreOffice
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
AI Analysis
Technical Summary
LibreOffice Draw's PDF import functionality contains a heap buffer overflow due to improper validation of the stream length. The length is derived from the stream object's dictionary and is not checked against the actual data size, causing the program to read and write beyond the allocated buffer. This vulnerability is identified as CWE-787 (Out-of-bounds Write) and CWE-125 (Out-of-bounds Read). The flaw affects LibreOffice version 26.2. Fixed versions clamp the declared length to the actual bytes read, preventing overflow.
Potential Impact
The vulnerability allows out-of-bounds writes on the heap when importing crafted PDF documents, potentially leading to memory corruption. This could result in application crashes or other undefined behavior. The CVSS score of 5.4 indicates a medium impact, with local attack vector and low complexity. No known exploits are reported in the wild.
Mitigation Recommendations
No official patch or fix links are provided in the available data. Patch status is not yet confirmed — check The Document Foundation's vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted PDF documents with LibreOffice Draw version 26.2.
CVE-2026-63274: CWE-787 Out-of-bounds Write in The Document Foundation LibreOffice
Description
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
CVSS v4.0
Score 5.4medium
Affected software
The Document Foundation
LibreOffice
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
LibreOffice Draw's PDF import functionality contains a heap buffer overflow due to improper validation of the stream length. The length is derived from the stream object's dictionary and is not checked against the actual data size, causing the program to read and write beyond the allocated buffer. This vulnerability is identified as CWE-787 (Out-of-bounds Write) and CWE-125 (Out-of-bounds Read). The flaw affects LibreOffice version 26.2. Fixed versions clamp the declared length to the actual bytes read, preventing overflow.
Potential Impact
The vulnerability allows out-of-bounds writes on the heap when importing crafted PDF documents, potentially leading to memory corruption. This could result in application crashes or other undefined behavior. The CVSS score of 5.4 indicates a medium impact, with local attack vector and low complexity. No known exploits are reported in the wild.
Mitigation Recommendations
No official patch or fix links are provided in the available data. Patch status is not yet confirmed — check The Document Foundation's vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted PDF documents with LibreOffice Draw version 26.2.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Document Fdn.
- Date Reserved
- 2026-07-16T08:17:05.512Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab2677df7a7c541061982d9
Added to database: 09/22/2026, 11:33:17 UTC
Last enriched: 09/22/2026, 11:48:20 UTC
Last updated: 09/22/2026, 15:44:11 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.