CVE-2026-63272 Overview
CVE-2026-63272 is a heap buffer overflow in LibreOffice's Windows Metafile (WMF) graphics import path. The flaw affects the handling of text records that carry their own character advance widths. LibreOffice reads the count of advance values and the length of the text separately from the file, without validating that both counts agree. When the advance array is shorter than the text, drawing the text walks past the end of the array, triggering an out-of-bounds read [CWE-125].
Exploitation requires a user to open a crafted document containing an embedded WMF graphic. Fixed versions ignore advance arrays that are shorter than the associated text.
Critical Impact
Opening a crafted document with an embedded WMF graphic can trigger an out-of-bounds heap read in LibreOffice, potentially leading to application crash or memory disclosure.
Affected Products
- LibreOffice (WMF graphics import component)
- Documents supporting embedded WMF graphics processed by LibreOffice
- See the LibreOffice Security Advisory CVE-2026-63272 for exact fixed versions
Discovery Timeline
- 2026-09-22 - CVE CVE-2026-63272 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-63272
Vulnerability Analysis
The vulnerability resides in LibreOffice's WMF import code that parses text drawing records. WMF text records can carry an optional array of character advance widths controlling per-character horizontal spacing. The parser reads two independent length fields from the file: the character count of the text string and the count of entries in the advance array.
LibreOffice trusts both values without cross-validation. When drawing, the renderer iterates the advance array indexed by character position. If the advance array is shorter than the text, the loop reads past the end of the heap-allocated array. This is an out-of-bounds read on the heap, classified under [CWE-125].
Consequences include process crash, denial of service, and potential disclosure of adjacent heap memory. See the LibreOffice Security Advisory for full technical detail.
Root Cause
The root cause is missing validation between two related length fields parsed from untrusted file data. The character count and the advance-array count are treated as independent, but the drawing loop assumes they are consistent. No bounds check guards the advance-array access during iteration.
Attack Vector
Exploitation is local and requires user interaction. An attacker crafts a document containing an embedded WMF graphic whose text record specifies a text length larger than its advance-array length. The victim opens the document in a vulnerable LibreOffice build. The WMF importer parses the record, and rendering triggers the out-of-bounds read.
No network access, credentials, or elevated privileges are required. Delivery typically occurs through phishing attachments, shared documents, or files sourced from untrusted repositories.
Detection Methods for CVE-2026-63272
Indicators of Compromise
- Unexpected LibreOffice (soffice.bin) crashes shortly after opening a document containing embedded graphics
- Inbound documents (ODT, DOCX, RTF) carrying embedded WMF streams from untrusted senders
- Crash telemetry referencing WMF import or metafile text-drawing routines
Detection Strategies
- Inspect email and file-sharing gateways for Office documents with embedded WMF objects and correlate against sender reputation
- Monitor endpoint crash reports for soffice.bin faults with heap read access violations
- Use file-content inspection to flag WMF records where the text length and advance-array length differ
Monitoring Recommendations
- Enable and forward LibreOffice application crash logs to a centralized SIEM for correlation
- Track process-launch chains where mail clients or browsers spawn soffice.bin with attachments from external sources
- Alert on repeated LibreOffice crashes on the same host, which may indicate exploitation attempts
How to Mitigate CVE-2026-63272
Immediate Actions Required
- Upgrade LibreOffice to a fixed version as listed in the LibreOffice Security Advisory CVE-2026-63272
- Restrict opening of documents from untrusted sources until patching completes
- Communicate risk guidance to end users, emphasizing caution with unexpected document attachments
Patch Information
The LibreOffice project has released fixed builds in which an advance array shorter than its associated text is ignored during WMF import. Refer to the vendor advisory for the specific patched release numbers and download locations.
Workarounds
- Disable or block import of WMF graphics in enterprise document workflows where feasible
- Preview untrusted documents in a sandboxed or virtualized environment before opening on production endpoints
- Convert incoming documents to safer formats through a gateway that strips or rasterizes embedded metafiles
# Verify installed LibreOffice version and upgrade on Linux
libreoffice --version
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade libreoffice
# Fedora/RHEL
sudo dnf upgrade libreoffice*
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
