CVE-2026-63275: Stack buffer overflow in CFF font hint handling
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Users or systems that open LibreOffice documents containing embedded CFF fonts are exposed. A malicious glyph in an embedded CFF font can declare more hints than the affected array can hold.
What must an attacker provide to trigger the overflow?
An attacker needs to cause LibreOffice to read a CFF font with a glyph whose declared hint count exceeds the array capacity. The available data indicates that CFF fonts may be embedded in documents.
How can I determine whether a version is affected?
The provided information does not identify affected or fixed LibreOffice version numbers. Check the vendor advisory for CVE-2026-63275 and confirm whether the installed version includes the fix that validates hint counts against the actual array capacity.