CVE-2026-63279 Overview
CVE-2026-63279 is an out-of-bounds read vulnerability in LibreOffice's PICT image import functionality. LibreOffice can embed PICT images inside documents, and the parser reads a palette index from the image data. The affected code uses that index without validating it against the actual number of palette entries. A crafted PICT image with an oversized index causes the parser to read memory beyond the palette buffer. The flaw is tracked under [CWE-125] (Out-of-Bounds Read) and requires a user to open a malicious document. Fixed releases clamp the palette index to the entries present in the image.
Critical Impact
A crafted PICT image embedded in a document can trigger an out-of-bounds read in LibreOffice, potentially disclosing adjacent memory or crashing the application.
Affected Products
- LibreOffice (versions prior to the fixed release addressing CVE-2026-63279)
- Documents containing embedded PICT images processed by LibreOffice
- Downstream LibreOffice-based distributions and packages
Discovery Timeline
- 2026-09-22 - CVE-2026-63279 published to the National Vulnerability Database
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-63279
Vulnerability Analysis
The vulnerability sits in the PICT (QuickDraw Picture) image import path used when LibreOffice renders embedded images in documents. PICT images can reference colors through a color palette (color table). Each pixel stores an index that selects an entry in that palette.
The LibreOffice import code reads the palette index straight from the image data and dereferences it against the palette buffer. It does not compare the index against the palette's declared entry count. When the index is larger than the last valid entry, the read reaches memory beyond the palette allocation.
The consequence is an out-of-bounds read of process memory. The exposed bytes may leak into the rendered image or influence subsequent operations. Depending on the process layout, the read can also cause a crash and denial of service against the LibreOffice process.
Root Cause
The root cause is missing bounds validation on attacker-controlled input. The palette index in the PICT data is a value chosen by whoever authored the image. Trusting that value without a length check violates the standard input-validation contract for parsers that handle untrusted files. The fix constrains the index to the range of entries actually present in the palette.
Attack Vector
Exploitation requires local user interaction. An attacker crafts a document containing a malicious PICT image and delivers it through email, file share, or download. When the victim opens the document in a vulnerable LibreOffice build, the import routine parses the image and triggers the out-of-bounds read. No network access or elevated privileges are required on the target system.
The vulnerability is described in the LibreOffice Security Advisory CVE-2026-63279. No public proof-of-concept exploit is currently listed for this CVE.
Detection Methods for CVE-2026-63279
Indicators of Compromise
- Office documents (ODT, ODP, DOC, DOCX, PPT) containing embedded PICT images from untrusted senders
- LibreOffice process crashes (soffice.bin) shortly after opening a document with embedded images
- Unexpected memory access violations logged by the operating system for LibreOffice processes
Detection Strategies
- Inspect inbound email attachments and file shares for documents that embed PICT streams, and route them through a sandbox before delivery
- Alert on LibreOffice process crashes correlated with document-open events on user endpoints
- Track LibreOffice versions across the fleet through software inventory and flag hosts running builds below the patched release
Monitoring Recommendations
- Collect endpoint telemetry for soffice, soffice.bin, and related LibreOffice binaries, including process termination and exception events
- Log document-open activity from mail clients and browsers to correlate crashes with a specific source file
- Retain suspect documents for offline analysis to confirm the presence of malformed PICT palette data
How to Mitigate CVE-2026-63279
Immediate Actions Required
- Upgrade LibreOffice to the fixed version referenced in the LibreOffice Security Advisory CVE-2026-63279
- Instruct users to avoid opening documents from untrusted sources, particularly documents containing embedded legacy image formats
- Prioritize patch deployment on shared workstations and systems that regularly process third-party documents
Patch Information
The Document Foundation has released fixed LibreOffice versions that limit the palette index to the entries actually present in the image, eliminating the out-of-bounds read. Refer to the LibreOffice Security Advisory CVE-2026-63279 for the exact fixed versions and download locations. Linux distributions may ship the fix through package updates; apply the vendor-provided update once available.
Workarounds
- Block or strip documents containing embedded PICT images at the mail gateway when the patched version cannot be deployed immediately
- Open untrusted documents inside an isolated virtual machine or a sandboxed viewer rather than the primary desktop LibreOffice installation
- Restrict use of legacy image import filters through LibreOffice configuration policies where organizational needs allow
# Verify installed LibreOffice version on Linux
libreoffice --version
# Debian/Ubuntu: apply vendor-provided update
sudo apt update && sudo apt install --only-upgrade libreoffice
# Fedora/RHEL: apply vendor-provided update
sudo dnf upgrade libreoffice
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.