CVE-2026-63274: Heap buffer overflow in PDF import stream handling
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to provide to trigger this issue?
The attacker needs to supply a PDF containing a stream object whose dictionary declares a length larger than the bytes actually present in the stream.
Which users are exposed?
Users are exposed when LibreOffice Draw imports PDF documents. The vulnerable processing occurs during handling of PDF stream objects.
What behavior indicates that a fix is present?
In fixed versions, the declared stream length is clamped to the number of bytes actually read before the stream is copied.