CVE-2026-63274: LibreOffice Draw Buffer Overflow Vulnerability

CVE-2026-63274 Overview

CVE-2026-63274 is a heap buffer overflow [CWE-125] in LibreOffice Draw's PDF import functionality. The flaw occurs when Draw parses a stream object inside a PDF document. The parser trusts the declared stream length from the object's own dictionary without validating it against the number of bytes actually available in the buffer. Copying the stream then reads and writes past the end of the allocated heap region. An attacker can trigger the condition by convincing a user to open a crafted PDF file in LibreOffice Draw.

Critical Impact
Opening a malicious PDF in LibreOffice Draw can corrupt heap memory, leading to application crashes or potential memory disclosure and code execution scenarios.

Affected Products

LibreOffice Draw (PDF import component)
LibreOffice suite versions prior to the fixed release documented in the vendor advisory
Downstream distributions bundling vulnerable LibreOffice packages

Discovery Timeline

2026-09-22 - CVE-2026-63274 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-63274

Vulnerability Analysis

LibreOffice Draw includes a PDF import filter that parses arbitrary PDF documents for editing. Inside a PDF, stream objects carry binary payloads such as images, fonts, and compressed content. Each stream object declares its size in the associated dictionary using the /Length entry. The import filter allocated a buffer sized to that declared length and then copied data into it during processing.

The vulnerability arises because the import code did not reconcile the declared /Length value with the actual number of bytes read from the file. When the declared length exceeds the bytes present in the stream, downstream copy operations traverse past the end of the source or destination buffer on the heap. The corruption is deterministic and controllable through the PDF content.

Fixed versions clamp the declared length to the number of bytes actually read before any copy operation proceeds. This eliminates the mismatch between the metadata and the physical buffer size.

Root Cause

The root cause is missing bounds validation on attacker-controlled metadata. The stream reader treated the dictionary's /Length field as authoritative rather than as untrusted input. No cross-check was performed against the underlying SvStream byte count before the copy operation, producing an out-of-bounds access on the heap.

Attack Vector

Exploitation requires local user interaction. A victim must open a crafted PDF document in LibreOffice Draw. An attacker delivers the file through email attachments, file-sharing platforms, or web downloads. Once the file is opened, the malformed stream object triggers the overflow during import. Successful exploitation can crash the application, disclose adjacent heap memory, or corrupt heap metadata that an attacker can shape into further primitives.

No exploit code is publicly available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-63274

Indicators of Compromise

Unexpected crashes of soffice.bin or the LibreOffice Draw process shortly after opening a PDF attachment
PDF files whose stream /Length values in object dictionaries are inconsistent with the actual byte content between stream and endstream markers
Heap corruption signatures in application crash dumps referencing PDF import call stacks

Detection Strategies

Inspect PDF documents received from external sources for malformed stream length metadata using dedicated PDF parsers
Correlate LibreOffice process crashes with recent file-open events from mail, browser, or messaging clients
Enable operating system exploit mitigations such as heap protection and monitor for their trigger events tied to soffice processes

Monitoring Recommendations

Forward endpoint process and crash telemetry to a centralized data lake for correlation with PDF file provenance
Track LibreOffice version inventory across managed endpoints to identify hosts still running vulnerable builds
Alert on child process creation from soffice.bin following the opening of documents from untrusted origins

How to Mitigate CVE-2026-63274

Immediate Actions Required

Upgrade LibreOffice to the fixed version identified in the LibreOffice Security Advisory CVE-2026-63274
Restrict opening of PDF files from untrusted sources in LibreOffice Draw until patches are applied
Prefer dedicated PDF viewers with sandboxing for routine PDF viewing rather than editing tools

Patch Information

The Document Foundation has released fixed LibreOffice versions that clamp the declared stream length to the number of bytes actually read. Consult the LibreOffice Security Advisory CVE-2026-63274 for the exact fixed release numbers and download links. Linux distribution maintainers typically publish backported packages through their standard security update channels.

Workarounds

Disable the PDF import filter in LibreOffice via Tools > Options if editing PDFs in Draw is not required
Route inbound PDF attachments through a sanitization gateway that rewrites or rejects malformed streams
Apply application allowlisting to prevent unexpected child processes spawned from soffice.bin

bash

# Verify installed LibreOffice version on Linux endpoints
soffice --version

# Debian/Ubuntu: apply pending security updates
sudo apt update && sudo apt upgrade libreoffice libreoffice-draw

# RHEL/Fedora: apply pending security updates
sudo dnf upgrade libreoffice libreoffice-draw