CVE-2026-63276

A flaw was found in LibreOffice. When a user exports a document with crafted embedded fonts to PDF, a stack-based buffer overflow can occur during the conversion of CFF fonts to Type 1 fonts due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash.

To exploit this issue, an attacker needs to convince a user to export a specially crafted document to PDF. This flaw can cause memory corruption, resulting in an application crash. However, the possibility of arbitrary code execution is not discarded. For these reasons, this vulnerability has been rated with a moderate severity.

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not export documents from unknown or untrusted sources to PDF with LibreOffice.