CVE-2026-63275: The Document Foundation Libreoffice

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.

Affected products

• The Document Foundation Libreoffice: from 26.2, before 26.2.5 (fixed in 26.2.5)

Published 2026-09-22. Last modified 2026-09-22.