Vulnerability · Published Sep 22, 2026 · Assigned by Document Fdn.
CVE-2026-63272Heap buffer overflow in WMF text record import
Medium 5.4
In plain English
A medium-severity out-of-bounds write in LibreOffice from The Document Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libreoffice | no fix listed | DEBIAN-CVE-2026-63272 |
| Debian:13 | libreoffice | 4:25.2.3-2+deb13u7 | DEBIAN-CVE-2026-63272 |
| Debian:14 | libreoffice | 4:26.2.5.2-1 | DEBIAN-CVE-2026-63272 |
| Ubuntu:22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.13 | UBUNTU-CVE-2026-63272 |
| Ubuntu:22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.13 | USN-8868-1 |
| Ubuntu:24.04:LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.7 | USN-8868-1 |
| Ubuntu:24.04:LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.7 | UBUNTU-CVE-2026-63272 |
| Ubuntu:26.04:LTS | libreoffice | 4:26.2.6.3-0ubuntu0.26.04.2 | USN-8868-1 |
| Ubuntu:26.04:LTS | libreoffice | 4:26.2.6.3-0ubuntu0.26.04.2 | UBUNTU-CVE-2026-63272 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Document Foundation | LibreOffice | 26.2 – before < 26.2.5 |
Weakness: CWE-787, CWE-125 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P