CVE-2026-63269: the document foundation libreoffice
Vulnerability summary
CVE-2026-63269 is a medium (CVSS 6.7) vulnerability in the document foundation libreoffice. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 05-10-2026PublishedVulnerability first disclosed.
- 05-10-2026Last modifiedVulnerability information updated.
Description
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.7MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.7MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.7MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Debian1 product
- libreofficeAll versions (No fix recorded) | < 4:25.2.3-2+deb13u8 | < 4:26.2.5.2-1
The document foundation1 product
- libreoffice≥ 26.2, < < 26.2.5
Ubuntu1 product
- libreofficeAll versions (No fix recorded)
3 vendors · 3 products
