CVE-2026-63273
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
LibreOffice Draw can import PDF documents. A heap buffer overflow exists when importing an encrypted document because the decryption key length is taken from the document's encryption dictionary and used to fill a fixed-size key buffer without being checked. In fixed versions, a declared key length larger than the buffer is rejected.
Risk Assessment
Opening a malicious encrypted PDF in LibreOffice Draw could cause a heap buffer overflow, leading to a crash or potential code execution. This may result in remote code execution.
Recommendation
Update LibreOffice to a version that includes the fix rejecting an oversized key length. Do not open encrypted PDF files from untrusted sources.
Other vulnerabilities in LibreOffice
See all- CVE-2016-4324High
Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.
- CVE-2016-0795High
LibreOffice versions before 5.0.5 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document.
- CVE-2014-9093High
LibreOffice versions before 4.3.5 allow remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.
- CVE-2014-0247High
LibreOffice version 4.2.4 automatically executes unspecified VBA macros, which may lead to unknown impacts and attack vectors.
- CVE-2017-8358Critical
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.
- CVE-2017-7882Critical
LibreOffice before March 14, 2017, has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
- CVE-2017-7870Critical
LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.
- CVE-2017-7856Critical
LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function.
- CVE-2016-10327Critical
LibreOffice before December 22, 2016, has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx.
- CVE-2026-63277High
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
Original NVD description (English source)
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS