CVE-2026-63279: Out of bounds read in PICT image import
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the out-of-bounds read?
The attacker needs to supply a PICT image that uses a colour palette and contains image data with a palette index beyond the palette's available entries. The PICT image may be embedded in a document.
Which LibreOffice workflows are exposed?
LibreOffice installations that import PICT images are exposed to this condition. Documents containing embedded PICT images can carry the malformed image data.
How can I determine whether a document may be attempting to exploit this issue?
Inspect the document for embedded PICT images that use colour palettes, then check whether any image-data palette index exceeds the number of entries in its palette. Such an index is the condition described as causing the out-of-bounds read.