LibreOffice performs a conversion of CFF fonts to Type 1 when a document is subset for PDF export. During this conversion the glyph operators were written into a fixed-size buffer with no bounds checking. A glyph emitting many operators therefore writes past the end of the buffer, corrupting the stack and creating an opportunity for arbitrary code execution or denial of service. The weakness is a classic stack buffer overflow (CWE-787).

The vulnerability affects all editions of LibreOffice from the Document Foundation that have not applied the published patch. The fixed versions include a tracking mechanism that stops the conversion once the buffer is full, preventing the overflow. No specific sub-versions are listed, so users of any older release should treat the package as vulnerable until updated.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is < 1%, which suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been widely exploited. The likely attack vector is the processing of an untrusted document that contains embedded CFF fonts and is subsequently exported to PDF, triggering the conversion routine. Because the overflow occurs on the stack, a successful exploit could lead to arbitrary code execution or denial of service, but no proof of exploitation is reported in the public advisories.