CVE-2026-63273: the document foundation libreoffice Out-of-bounds Write

Vulnerability summary

CVE-2026-63273 is a medium (CVSS 5.4) Out-of-bounds Write vulnerability in the document foundation libreoffice. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.7% of scored vulnerabilities.

Timeline

1. 22-09-2026
   PublishedVulnerability first disclosed.
2. 28-09-2026
   Last modifiedVulnerability information updated.

Description

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.