Vulnerability · Published Sep 22, 2026 · Assigned by Document Fdn.
CVE-2026-63273Heap buffer overflow in PDF import encryption handling
Medium 5.4
In plain English
A medium-severity out-of-bounds write in LibreOffice from The Document Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libreoffice | no fix listed | DEBIAN-CVE-2026-63273 |
| Debian:13 | libreoffice | 4:25.2.3-2+deb13u7 | DEBIAN-CVE-2026-63273 |
| Debian:14 | libreoffice | 4:26.2.5.2-1 | DEBIAN-CVE-2026-63273 |
| Ubuntu:22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.13 | UBUNTU-CVE-2026-63273 |
| Ubuntu:22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.13 | USN-8868-1 |
| Ubuntu:24.04:LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.7 | USN-8868-1 |
| Ubuntu:24.04:LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.7 | UBUNTU-CVE-2026-63273 |
| Ubuntu:26.04:LTS | libreoffice | 4:26.2.6.3-0ubuntu0.26.04.2 | USN-8868-1 |
| Ubuntu:26.04:LTS | libreoffice | 4:26.2.6.3-0ubuntu0.26.04.2 | UBUNTU-CVE-2026-63273 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Document Foundation | LibreOffice | 26.2 – before < 26.2.5 |
Weakness: CWE-787 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P