CVE-2026-63274

A flaw was found in LibreOffice. When a user imports a specially crafted PDF document with LibreOffice Draw, a heap-based buffer overflow can occur due to improper validation of the stream length. This issue can cause memory corruption, resulting in an application crash.

To exploit this issue, an attacker needs to convince a user to import a specially crafted PDF document. This flaw can cause memory corruption, resulting in an application crash. However, the possibility of arbitrary code execution is not discarded. For these reasons, this vulnerability has been rated with a moderate severity.

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not import PDF documents from unknown or untrusted sources with LibreOffice Draw.