CVE-2026-63272
Heap buffer overflow in WMF text record import
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.
| CWE | CWE-787 CWE-125 |
| Vendor | the document foundation |
| Product | libreoffice |
| Published | Sep 22, 2026 |
| Last Updated | Sep 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for the document foundation libreoffice
Be the first to know when new unknown vulnerabilities affecting the document foundation libreoffice are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
The Document Foundation / LibreOffice
26.2 < < 26.2.5
References
Credits
Claude, found by Anthropic using agents to study the security of open-source projects Ada Logics, validating and reporting Caolán McNamara of Collabora Productivity