CVE-2026-63273: LibreOffice Draw Buffer Overflow Vulnerability

CVE-2026-63273 Overview

CVE-2026-63273 is a heap buffer overflow [CWE-787] in LibreOffice Draw's encrypted PDF import functionality. The flaw resides in the decryption routine, which reads the key length directly from an untrusted PDF encryption dictionary. LibreOffice Draw copies the key into a fixed-size buffer without validating the declared length against the buffer size. An attacker who convinces a user to open a crafted encrypted PDF can trigger an out-of-bounds write on the heap. The issue affects local users who open malicious documents and requires user interaction. Fixed builds now reject any declared key length larger than the destination buffer.

Critical Impact
A crafted encrypted PDF opened in LibreOffice Draw writes past a fixed-size decryption key buffer, corrupting heap memory and potentially enabling code execution.

Affected Products

LibreOffice Draw (PDF import component)
LibreOffice Suite versions prior to the fixed release
Downstream distributions bundling vulnerable LibreOffice builds

Discovery Timeline

2026-09-22 - CVE-2026-63273 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-63273

Vulnerability Analysis

LibreOffice Draw supports importing PDF documents, including encrypted PDFs that require a decryption key. Encrypted PDFs store metadata about the encryption algorithm and key length inside an encryption dictionary within the document structure. The vulnerable code path parses this dictionary to determine how many bytes of key material to copy into an internal buffer.

The decryption routine allocates a fixed-size stack or heap buffer sized for the maximum key length supported by the specification. However, the length value driving the copy operation is taken from the document itself rather than clamped to the buffer's capacity. When the declared length exceeds the buffer size, the copy operation writes attacker-controlled bytes past the end of the allocation.

Exploitation requires a user to open a crafted PDF in LibreOffice Draw. The resulting heap corruption can overwrite adjacent metadata or object pointers, which in advanced exploitation scenarios leads to arbitrary code execution in the context of the user running LibreOffice.

Root Cause

The root cause is missing bounds validation between an attacker-controlled length field and a fixed-size destination buffer. The encryption dictionary's key length value is trusted without comparison against sizeof(buffer) before the copy. This is a classic [CWE-787] out-of-bounds write pattern where input validation is deferred to the parser rather than enforced at the copy boundary.

Attack Vector

The attack requires local file access and user interaction. An attacker crafts a malicious encrypted PDF containing an oversized key length declaration in its encryption dictionary and delivers it via email, file share, or web download. When the victim opens the file in LibreOffice Draw, the heap buffer overflow triggers during the PDF import phase, before any user-visible rendering occurs.

The vulnerability mechanism is described in the LibreOffice Security Advisory CVE-2026-63273. No verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-63273

Indicators of Compromise

Unexpected LibreOffice Draw crashes or soffice.bin process termination shortly after opening a PDF file
PDF files with malformed or oversized /Length values inside the encryption dictionary
Crash dumps referencing heap corruption in LibreOffice PDF import modules
Child processes spawned by soffice.bin that deviate from normal document workflows

Detection Strategies

Inspect inbound PDF attachments for encryption dictionaries declaring key lengths above 32 bytes, which exceeds standard PDF specifications
Monitor endpoint telemetry for LibreOffice process crashes correlated with PDF file opens
Deploy YARA rules that flag PDFs with anomalous /Length fields inside /Encrypt dictionaries

Monitoring Recommendations

Enable process crash reporting for soffice.bin and forward events to your central logging platform
Track command-line invocations of LibreOffice Draw opening files from untrusted locations such as email temp directories or browser downloads
Alert on unusual child process creation from LibreOffice executables, which may indicate successful exploitation

How to Mitigate CVE-2026-63273

Immediate Actions Required

Upgrade LibreOffice to the fixed version listed in the vendor advisory as soon as it becomes available in your distribution channel
Restrict opening of encrypted PDFs from untrusted sources until patches are applied
Communicate the risk to end users and reinforce guidance to avoid opening unsolicited PDF attachments in LibreOffice Draw

Patch Information

The LibreOffice project has released fixed versions that reject any declared decryption key length larger than the destination buffer. Consult the LibreOffice Security Advisory CVE-2026-63273 for exact version numbers and download links. Distribution maintainers should pull the upstream fix into supported package repositories.

Workarounds

Use an alternative PDF viewer for encrypted PDF documents until LibreOffice is patched
Disable or remove the PDF import extension in LibreOffice Draw if it is not required for business workflows
Apply application allowlisting or sandboxing to constrain LibreOffice process privileges and limit blast radius from a successful exploit

bash

# Verify installed LibreOffice version on Linux
soffice --version

# Example: remove the PDF import component on Debian/Ubuntu if not needed
sudo apt-get remove libreoffice-pdfimport