CVE-2022-29777: ONLYOFFICE Core

Critical severity, CVSS 9.8. EPSS: 6.9% chance of exploitation in the next 30 days.

Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h.

Affected products

• ONLYOFFICE Core: up to and including 6.1.0.26
• ONLYOFFICE Document Server: up to and including 6.0.0

Published 2022-06-02. Last modified 2026-06-17.