CVE-2026-63272: The Document Foundation LibreOffice, грешка в паметта

Описание

Оригинално описание

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.

Засегнати продукти

• The Document Foundation LibreOffice: 26.2 преди < 26.2.5

Вид слабост

• CWE-787 Out-of-bounds Write
• CWE-125 Четене извън границите на буфера

История

Други уязвимости в The Document Foundation LibreOffice

• 6.7CVE-2026-63270
• 6.7CVE-2026-63269
• 6.7CVE-2026-63268
• 6.7CVE-2026-63267
• 6.8CVE-2026-63266

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-63272
• https://nvd.nist.gov/vuln/detail/CVE-2026-63272
• https://www.libreoffice.org/about-us/security/advisories/cve-2026-63272