CVE-2026-63279: Out of bounds read in PICT image import
Last updated 5 October 2026
Other sources
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libreofficeto a version that resolves this vulnerability.Fixed in 4:25.2.3-2+deb13u7Fixed in 4:26.8.0.3-2Fixed in 4:26.8.1.1-2
Event History
Frequently Asked Questions
What must an attacker provide to trigger the out-of-bounds read?
The attacker needs to supply a PICT image that uses a colour palette and contains image data with a palette index beyond the palette's available entries. The PICT image may be embedded in a document.
Which LibreOffice workflows are exposed?
LibreOffice installations that import PICT images are exposed to this condition. Documents containing embedded PICT images can carry the malformed image data.
How can I determine whether a document may be attempting to exploit this issue?
Inspect the document for embedded PICT images that use colour palettes, then check whether any image-data palette index exceeds the number of entries in its palette. Such an index is the condition described as causing the out-of-bounds read.