CVE-2026-63272: Heap buffer overflow in WMF text record import
Last updated 5 October 2026
Other sources
LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libreofficeto a version that resolves this vulnerability.Fixed in 4:25.2.3-2+deb13u7Fixed in 4:26.8.0.3-2Fixed in 4:26.8.1.1-2
Event History
Frequently Asked Questions
Which LibreOffice users are exposed?
Users who import WMF graphics are exposed, including when WMF graphics are embedded in documents.
What does a malicious file need to contain to trigger the issue?
It must contain a WMF text record with character advance widths whose declared count is shorter than the text length. Processing the text can then read beyond the end of the advance array.
What is the available mitigation if affected files cannot be trusted?
Use a fixed LibreOffice version. In fixed versions, an advance-width array that is shorter than its associated text is ignored.