CVE-2026-63276: LibreOffice CFF Font Buffer Overflow Vulnerability

CVE-2026-63276 Overview

CVE-2026-63276 is a stack buffer overflow in LibreOffice's Compact Font Format (CFF) to Type 1 font conversion routine. LibreOffice performs this conversion when it subsets a font, an operation triggered when a document is exported to Portable Document Format (PDF). Because CFF fonts may be embedded within documents, a crafted document can supply a malicious font that overflows a fixed-size stack buffer during subsetting. The converted operators were written into the buffer with no capacity check, so a glyph emitting many operators wrote past the end. Exploitation requires a local user to open and export a malicious document. The vulnerability is classified under [CWE-787] (Out-of-bounds Write).

Critical Impact
A crafted document containing a malicious CFF font can corrupt stack memory in the LibreOffice process during PDF export, leading to application crashes and potential code execution in the user's context.

Affected Products

LibreOffice (versions prior to the fix referenced in the vendor advisory)
Documents containing embedded CFF fonts processed by LibreOffice PDF export
Downstream distributions bundling vulnerable LibreOffice builds

Discovery Timeline

2026-09-22 - CVE-2026-63276 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-63276

Vulnerability Analysis

LibreOffice converts CFF fonts to Type 1 format when it subsets a font, an operation performed during PDF export. The conversion routine writes translated operators into a fixed-size stack buffer. The vulnerable code path does not track the remaining capacity of that buffer while emitting operators for each glyph.

A glyph that expands into many operators produces more output than the destination buffer can hold. The writer continues past the end of the buffer and corrupts adjacent stack memory, including saved registers and return addresses. This meets the definition of an out-of-bounds write [CWE-787].

Because the overflow occurs in a subroutine invoked during a routine user workflow (exporting a document to PDF), any embedded CFF font can trigger the flaw. Fixed versions track the remaining buffer capacity and terminate the conversion once it is exhausted.

Root Cause

The root cause is missing bounds validation during CFF-to-Type 1 operator emission. The destination buffer has a fixed size, but the conversion loop does not compare the number of bytes remaining against the size of the next operator being written. Font data is attacker-controlled when embedded in a document, so a glyph program can be constructed to emit an unbounded operator stream.

Attack Vector

An attacker crafts a document (for example, an ODF or DOCX file) with an embedded CFF font whose glyph programs emit a large number of Type 1 operators. The attacker delivers the document via email, file share, or web download. When a user opens the document in LibreOffice and initiates PDF export, or when subsetting is otherwise triggered, the overflow occurs. User interaction is required, and the attack is local to the process performing the conversion.

No verified public exploit code is available at the time of publication. Refer to the LibreOffice Security Advisory CVE-2026-63276 for vendor technical details.

Detection Methods for CVE-2026-63276

Indicators of Compromise

Unexpected crashes of soffice.bin or soffice.exe during PDF export operations
Documents received from untrusted sources containing embedded CFF fonts with unusually large or complex glyph programs
Core dumps or Windows Error Reporting entries referencing the LibreOffice font subsetting code paths

Detection Strategies

Inspect inbound documents for embedded CFF font tables and flag files whose glyph CharStrings exceed typical size thresholds
Monitor endpoints for LibreOffice process termination signals (SIGSEGV, access violations) correlated with document open or export events
Correlate document delivery telemetry (email, web downloads) with subsequent LibreOffice crash telemetry to identify targeted delivery

Monitoring Recommendations

Enable application crash telemetry collection on endpoints running LibreOffice and forward events to a centralized data lake
Track PDF export activity from LibreOffice and alert on repeated failures involving the same source document
Maintain an inventory of LibreOffice versions across the fleet to identify hosts that have not received the fixed build

How to Mitigate CVE-2026-63276

Immediate Actions Required

Upgrade LibreOffice to the fixed version identified in the vendor advisory as soon as it is available in your distribution channel
Restrict opening of documents from untrusted sources until patched builds are deployed
Communicate the risk to end users and provide guidance on identifying suspicious attachments

Patch Information

The LibreOffice project has released fixed versions in which the CFF-to-Type 1 conversion tracks the remaining buffer capacity and stops when it is exhausted. Refer to the LibreOffice Security Advisory CVE-2026-63276 for the specific fixed version numbers and distribution-specific packages.

Workarounds

Avoid exporting untrusted documents to PDF until the patch is applied
Where possible, disable embedded font usage or strip embedded CFF fonts from documents before opening them in LibreOffice
Open suspicious documents inside a sandboxed environment or virtual machine with no access to sensitive data

bash

# Verify the installed LibreOffice version on Linux
libreoffice --version

# Update via distribution package manager (example: Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade libreoffice

# Update via Flatpak
flatpak update org.libreoffice.LibreOffice