Vulnerability · Published Oct 5, 2026 · Assigned by Document Fdn.
CVE-2026-63269LFI and GET SSRF via GStreamer and HLS playlists
Medium 6.7
In plain English
A medium-severity server-side request forgery in LibreOffice from The Document Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libreoffice | no fix listed | DEBIAN-CVE-2026-63269 |
| Debian:13 | libreoffice | 4:25.2.3-2+deb13u8 | DEBIAN-CVE-2026-63269 |
| Debian:14 | libreoffice | 4:26.2.5.2-1 | DEBIAN-CVE-2026-63269 |
| Ubuntu:22.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63269 |
| Ubuntu:24.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63269 |
| Ubuntu:26.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63269 |
| Ubuntu:26.10 | libreoffice | no fix listed | UBUNTU-CVE-2026-63269 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Document Foundation | LibreOffice | 26.2 – before < 26.2.5 |
Weakness: CWE-918, CWE-200 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N