LibreOffice versions including 26.2 contain a stack buffer overflow vulnerability (CWE-787) in the font conversion process that occurs when subsetting CFF fonts embedded in documents during PDF export. The conversion writes operators into a fixed-size buffer without bounds checking, allowing a glyph with many operators to write past the buffer's end. This vulnerability can cause memory corruption. Fixed versions implement tracking of remaining buffer capacity to prevent overflow by stopping conversion once the buffer is full.

The vulnerability allows out-of-bounds writes on the stack during font conversion, potentially leading to memory corruption. This could affect the stability of LibreOffice or be leveraged for further attacks, though no known exploits are reported in the wild. The CVSS 4.0 score is 5.4 (medium severity), reflecting local attack vector with low complexity and partial impact on confidentiality, integrity, and availability.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check The Document Foundation's vendor advisory for current remediation guidance. Users should monitor for official updates and apply fixes once available.