Medium severity · published Sep 22, 2026
CVE-2026-63275
Stack buffer overflow in CFF font hint handling
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibreOffice · The Document Foundation
26.2 before < 26.2.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63275
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63275
www.libreoffice.org
https://www.libreoffice.org/about-us/security/advisories/cve-2026-63275
More from LibreOffice
8.5
CVE-2026-63277
RCE via calcext:data-mappings, sql provider and jdbc connector
7.8
CVE-2026-8357
Heap buffer overflow in Calc formula compilation
7.8
CVE-2026-4430
Heap Buffer Overflow in AgileEngine
7.3
CVE-2026-6040
Heap use-after-free in ODF number-format blank-width parsing
6.8
CVE-2026-63266
Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality