CVE-2026-63273: Heap buffer overflow in PDF import encryption handling
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the overflow?
An attacker needs to supply an encrypted PDF whose encryption dictionary declares a decryption-key length larger than LibreOffice Draw's fixed-size key buffer. The issue is reached when Draw imports that document.
Who is exposed in practice?
Users or systems that import PDF documents with LibreOffice Draw are exposed to malicious encrypted PDFs. The provided information does not establish whether any particular default workflow automatically imports PDFs.
Is there a temporary mitigation if an update cannot be applied immediately?
Avoid importing encrypted PDFs from untrusted sources in LibreOffice Draw. The vulnerable path relies on processing the document-controlled encryption dictionary during PDF import.
How can I tell whether a PDF is attempting to exploit this issue?
The relevant condition is an encrypted PDF declaring a decryption-key length larger than Draw's fixed-size key buffer. The provided information does not specify a detectable threshold, file signature, or logging indicator.