Description
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
Published: 2026-09-22
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: Heap overflow could corrupt memory or crash LibreOffice Draw
Action: Immediate Patch
AI Analysis

Impact

LibreOffice Draw can import PDF documents. When a stream object is imported, the length of the stream is taken from the object's dictionary and is not checked against the actual number of bytes present. As a result, the routine that copies the stream overflows the heap buffer, potentially corrupting memory or causing a crash. This flaw corresponds to CWE-125 and CWE-787 and could lead to memory corruption or a crash.

Affected Systems

The Document Foundation’s LibreOffice suite, specifically the Draw component that handles PDF imports, is affected. Users running any of the supported operating systems (Windows, macOS, Linux) with an unpatched version may be impacted when the PDF import feature is used.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. The flaw requires a crafted PDF file to be processed by the application, so the likely attack vector is local file exploitation; a remote attacker would need the victim to open a malicious document. EPSS data is not available and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet. However, potential heap corruption could lead to crashes.

Generated by OpenCVE AI on September 22, 2026 at 13:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade LibreOffice to the latest version that contains the CVE-2026-63274 fix.
  • If an immediate upgrade is not feasible, disable or restrict the PDF import feature so that only trusted documents can be processed, or run LibreOffice in a sandboxed environment to isolate the vulnerable component.
  • If the PDF import must remain enabled, limit usage to signatures from trusted sources and monitor for anomalous crashes or behavior during document processing.

Generated by OpenCVE AI on September 22, 2026 at 13:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
Title Heap buffer overflow in PDF import stream handling
Weaknesses CWE-125
CWE-787
References
Metrics cvssV4_0

{'score': 5.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Document Fdn.

Published:

Updated: 2026-09-22T12:25:50.217Z

Reserved: 2026-07-16T08:17:05.512Z

Link: CVE-2026-63274

cve-icon Vulnrichment

Updated: 2026-09-22T12:25:46.333Z

cve-icon NVD

Status : Received

Published: 2026-09-22T12:17:13.147

Modified: 2026-09-22T13:17:10.410

Link: CVE-2026-63274

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T13:30:17Z

Weaknesses