{"schemaVersion":3,"id":"MGASA-2026-0514","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated libreoffice package fixes security vulnerabilities\n\nArbitrary file write via calcext:data-mappings, sql provider and\nFirebird backup functionality. (CVE-2026-63266)\nLFI and GET SSRF via calcext:data-mappings and csv provider.\n(CVE-2026-63267)\nLFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db\nhref. (CVE-2026-63268)\nLFI and GET SSRF via GStreamer and HLS playlists. (CVE-2026-63269)\nEnvironment/ini-file leaks. (CVE-2026-63270)\nHeap buffer overflow in WMF text record import. (CVE-2026-63272)\nHeap buffer overflow in PDF import encryption handling. (CVE-2026-63273)\nHeap buffer overflow in PDF import stream handling. (CVE-2026-63274)\nStack buffer overflow in CFF font hint handling. (CVE-2026-63275)\nStack buffer overflow in CFF to Type 1 font conversion. (CVE-2026-63276)\nRCE via calcext:data-mappings, sql provider and jdbc connector.\n(CVE-2026-63277)\nPackage URLs can be used to exfiltrate arbitrary INI file values and\nenvironment variables. (CVE-2026-63278)\nOut of bounds read in PICT image import. (CVE-2026-63279)","dates":{"published":"2026-10-17T03:21:49.000Z","modified":"2026-10-17T03:30:03.784Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"libreoffice","name":"libreoffice","label":"libreoffice","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/libreoffice","purlType":"rpm","versions":[{"text":"< 26.2.6.3-1.mga10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 26.2.6.3-1.mga10","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2026-0514.html","label":"advisories.mageia.org/MGASA-2026-0514.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36383","label":"bugs.mageia.org/show_bug.cgi?id=36383","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00424.html","label":"lists.debian.org/debian-security-announce/2026/msg00424.html","hostname":"lists.debian.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63272","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63273","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63274","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63275","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63276","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63277","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63278","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63279","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00457.html","label":"lists.debian.org/debian-security-announce/2026/msg00457.html","hostname":"lists.debian.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63266","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63267","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63268","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63269","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://www.libreoffice.org/security/#cve-2026-63270","label":"www.libreoffice.org/security/","hostname":"www.libreoffice.org","tags":["WEB"]},{"url":"https://ubuntu.com/security/notices/USN-8868-1","label":"ubuntu.com/security/notices/USN-8868-1","hostname":"ubuntu.com","tags":["Advisory"]}],"lineage":{"upstream":["CVE-2026-63266","CVE-2026-63267","CVE-2026-63268","CVE-2026-63269","CVE-2026-63270","CVE-2026-63272","CVE-2026-63273","CVE-2026-63274","CVE-2026-63275","CVE-2026-63276","CVE-2026-63277","CVE-2026-63278","CVE-2026-63279"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-17T03:21:49.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-17T03:30:03.784Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T15:44:39.843Z","stale":false,"partial":false}}