VULNERABILITY INTELLIGENCE

CVE-2026-63273

EPSS probability0.13%
CISA KEVNot currently listed
Published2026-09-22
Last modified2026-09-22

Description

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.

Weakness classification

  • security@documentfoundation.org: CWE-787

Primary references