CVE-2026-63269

A flaw was found in LibreOffice. When processing linked audio or video files on Linux systems, the application uses the GStreamer multimedia framework for playback. By convincing a victim to open a specially crafted document containing a malicious HTTP Live Streaming (HLS) playlist, an attacker can cause GStreamer to read arbitrary local files or remote resources. This flaw can lead to information disclosure, as the contents of sensitive local files may be exposed directly within the document.

A security flaw was found in LibreOffice on Linux platforms when rendering linked media files using the GStreamer framework. An attacker can exploit this by enticing a user to open a document with a crafted HTTP Live Streaming (HLS) playlist. When the document loads, GStreamer processes the playlist and reads local files or remote URLs specified within it. This can lead to sensitive local file contents being exposed directly inside the document context under the executing user's privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure LibreOffice to restrict automatic link updating by navigating to Tools -> Options -> LibreOffice -> General and setting "Update links when loading" to "On request" or "Never". Alternatively, refrain from opening untrusted documents containing linked multimedia files.