CVE-2026-63275: LibreOffice CFF Font Buffer Overflow

CVE-2026-63275 Overview

CVE-2026-63275 is a stack buffer overflow in LibreOffice's Compact Font Format (CFF) parser. LibreOffice reads CFF fonts embedded in documents. When parsing the hints of a glyph, the code checked the hint count against the wrong bound. A glyph declaring more hints than the fixed-size array can hold writes past the end of the stack buffer [CWE-787]. An attacker who convinces a user to open a crafted document can corrupt stack memory in the LibreOffice process. Fixed versions validate the hint count against the actual capacity of the array.

Critical Impact
Opening a malicious document containing a crafted CFF font triggers a stack buffer overflow that may crash LibreOffice or lead to code execution in the user's context.

Affected Products

LibreOffice (versions prior to the fix documented in the vendor advisory)
Documents with embedded CFF fonts processed by LibreOffice
Downstream distributions bundling vulnerable LibreOffice releases

Discovery Timeline

2026-09-22 - CVE-2026-63275 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-63275

Vulnerability Analysis

The flaw resides in LibreOffice's CFF font parser, which is invoked when the application reads fonts embedded inside documents. CFF glyphs may declare hints, which are numeric instructions describing stems used for grid fitting. LibreOffice stored these hints in a fixed-capacity array on the stack. The parser compared the declared hint count against an incorrect bound before writing hints into that array. A glyph declaring more hints than the array can hold caused writes past the end of the buffer, corrupting adjacent stack memory. This is a classic out-of-bounds write on the stack, categorized as [CWE-787].

Root Cause

The root cause is an incorrect bounds check. The code validated the hint count against a value that did not match the true capacity of the destination array. Fixed versions replace the comparison with the actual array capacity, so any hint count exceeding that value is rejected before the write occurs.

Attack Vector

Exploitation requires local user interaction. An attacker crafts a document that embeds a malicious CFF font with a glyph declaring an inflated hint count. When the victim opens the file in a vulnerable LibreOffice build, the parser writes attacker-controlled data past the end of a stack buffer. Consequences range from process crash and denial of service to potential control-flow hijacking, depending on stack layout and platform mitigations such as stack canaries, ASLR, and DEP. No verified public exploit was available at time of publication.

// No verified exploit code is available. See the LibreOffice security
// advisory for CVE-2026-63275 for technical details on the affected
// CFF hint parsing path and the corrected bounds check.

Detection Methods for CVE-2026-63275

Indicators of Compromise

Unexpected LibreOffice process crashes, particularly soffice.bin faults, occurring shortly after a user opens an office document
Documents originating from untrusted sources that embed custom or unusual CFF fonts
Crash dumps showing stack corruption or return-address overwrite within LibreOffice font-handling modules

Detection Strategies

Inspect inbound office documents at the mail and web gateways for embedded CFF font streams and flag anomalies in glyph hint counts
Monitor endpoint telemetry for abnormal child processes spawned by soffice.bin or soffice.exe after document open events
Correlate application crash events with recent document open activity to surface exploitation attempts against the LibreOffice parser

Monitoring Recommendations

Enable operating system crash reporting and forward Windows Error Reporting or Linux coredump events to a central log store
Track LibreOffice version inventory across managed endpoints and alert when hosts remain on versions predating the vendor fix
Baseline expected LibreOffice behavior so that unusual memory access patterns or fault addresses in font libraries stand out

How to Mitigate CVE-2026-63275

Immediate Actions Required

Upgrade LibreOffice to a fixed release as identified in the LibreOffice Security Advisory CVE-2026-63275
Block or quarantine untrusted office documents received by email or downloaded from the web until patches are deployed
Instruct users to avoid opening documents from unknown senders, especially files that render with unusual fonts

Patch Information

The Document Foundation published a security advisory for CVE-2026-63275 documenting the affected versions and the fix. In corrected builds, the CFF hint parser checks the declared hint count against the true capacity of the destination array and rejects glyphs that exceed it. Refer to the LibreOffice Security Advisory CVE-2026-63275 for the exact fixed version and upgrade guidance.

Workarounds

Where immediate patching is not possible, open untrusted documents in a sandboxed or ephemeral environment isolated from sensitive data
Disable or restrict rendering of embedded fonts through organizational policy where the office suite supports such controls
Convert untrusted documents to a safe intermediate format such as PDF using a hardened conversion service before distribution to end users

bash

# Example: verify installed LibreOffice version on Linux and Windows
soffice --version

# Debian/Ubuntu upgrade path once fixed packages are published
sudo apt update && sudo apt install --only-upgrade libreoffice

# Fedora upgrade path
sudo dnf upgrade libreoffice