LibreOffice can parse CFF fonts embedded in documents. A stack buffer overflow vulnerability exists when reading the hints of a glyph due to improper bounds checking of the hint count against the array capacity. If a glyph declares more hints than the array can hold, it causes out-of-bounds writes past the array's end. This vulnerability is identified as CWE-787 (Out-of-bounds Write). The affected version explicitly stated is 26.2. The vulnerability was published on 2026-09-22 and has a CVSS 4.0 score of 5.4.

The vulnerability allows an attacker to cause a stack buffer overflow by crafting a document with a specially crafted CFF font glyph containing an excessive number of hints. This can lead to memory corruption, which may result in application crashes or potentially arbitrary code execution depending on the exploitation context. The CVSS score reflects limited attack vector (local), low complexity, no privileges required, but user interaction is needed. The impact is rated medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the input data. Until a patch is available, avoid opening untrusted documents containing CFF fonts in LibreOffice version 26.2.