LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow occurs when the program processes a text record that carries its own character advance widths. The count of advance values and the length of the text are read separately and are not required to agree. When the advance array is shorter than the text, the drawing routine walks past its bounds, corrupting heap memory. This memory corruption can cause the application to crash or otherwise behave unpredictably, but the description does not indicate that arbitrary code execution is possible.

The affected product is LibreOffice, the open‑source office suite from The Document Foundation. The advisory does not list specific revision numbers, so any LibreOffice installation that still contains the legacy WMF import code is susceptible. Users should verify that their installed version incorporates the change that ignores an advance array shorter than the text.

The CVSS score of 5.4 indicates a medium severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no publicly known active exploitation. The likely attack surface is local: an attacker can craft a document containing a malicious WMF file and deliver it to a user or automated process that opens it in LibreOffice. Because the heap corruption is limited to the application space and no remote network access is implied, the risk remains moderate unless additional conditions allow further exploitation.