Description
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.
Published: 2026-09-22
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: Potential disclosure of arbitrary memory contents via an out‑of‑bounds read in PICT image import
Action: Apply Patch
AI Analysis

Impact

LibreOffice imports PICT images that may be embedded in documents. When such an image contains a colour palette, the palette index stored in the image data is used without checking it against the number of palette entries. This allows the reader to access memory outside the palette bounds, potentially exposing sensitive data present in adjacent memory.

Affected Systems

LibreOffice from The Document Foundation, any version that currently supports PICT image import and has not yet incorporated the recent patch

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate severity, with no EPSS data available and the vulnerability not listed in the CISA KEV catalog. An attacker would need to craft a malicious document containing a PICT image and then persuade a user to open it, typically via local or remote social engineering or a phishing attack. Once the document is loaded, the out‑of‑bounds read could leak memory material to the application, allowing access to proprietary or confidential data.

Generated by OpenCVE AI on September 22, 2026 at 12:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade LibreOffice to a version that includes the fix for the out‑of‑bounds read in PICT image import
  • If the issue remains unresolved or a patch is not yet available, disable the import of PICT images through LibreOffice’s options or settings
  • Exercise caution when opening documents from untrusted sources, particularly those that may embed PICT images

Generated by OpenCVE AI on September 22, 2026 at 12:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.
Title Out of bounds read in PICT image import
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 5.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Document Fdn.

Published:

Updated: 2026-09-22T12:16:55.755Z

Reserved: 2026-07-16T08:17:05.512Z

Link: CVE-2026-63279

cve-icon Vulnrichment

Updated: 2026-09-22T12:12:07.679Z

cve-icon NVD

Status : Received

Published: 2026-09-22T12:17:13.850

Modified: 2026-09-22T13:17:10.897

Link: CVE-2026-63279

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T12:30:07Z

Weaknesses