Medium severity · published Oct 5, 2026
CVE-2026-63269
LFI and GET SSRF via GStreamer and HLS playlists
6.7
CVSS
0.1%
EPSS
No
On KEV
Description
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibreOffice · The Document Foundation
26.2 before < 26.2.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63269
www.libreoffice.org
https://www.libreoffice.org/about-us/security/advisories/cve-2026-63269
More from LibreOffice
8.5
CVE-2026-63277
RCE via calcext:data-mappings, sql provider and jdbc connector
7.8
CVE-2026-8357
Heap buffer overflow in Calc formula compilation
7.8
CVE-2026-4430
Heap Buffer Overflow in AgileEngine
7.3
CVE-2026-6040
Heap use-after-free in ODF number-format blank-width parsing
6.8
CVE-2026-63266
Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality
