DEBIAN-CVE-2026-63272

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-63272

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63272.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-63272

Upstream

CVE-2026-63272

Published

2026-09-22T12:17:11Z

Modified

2026-09-23T05:01:21Z

Severity

5.4 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.

References

https://security-tracker.debian.org/tracker/CVE-2026-63272

Affected packages

Debian:12 / libreoffice

Package

Name: libreoffice
Purl: pkg:deb/debian/libreoffice?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4:7.*

4:7.4.5-3

4:7.4.7-1~bpo11+1

4:7.4.7-1

4:7.4.7-1+deb12u1~bpo11+1

4:7.4.7-1+deb12u1

4:7.4.7-1+deb12u2~bpo11+1

4:7.4.7-1+deb12u2

4:7.4.7-1+deb12u3

4:7.4.7-1+deb12u4

4:7.4.7-1+deb12u5

4:7.4.7-1+deb12u6

4:7.4.7-1+deb12u7

4:7.4.7-1+deb12u8

4:7.4.7-1+deb12u9

4:7.4.7-1+deb12u10

4:7.4.7-1+deb12u11

4:7.4.7-1+deb12u12

4:7.4.7-1+deb12u13

4:7.4.7-1+deb12u14

4:7.5.0~rc2-7

4:7.5.0~rc3-1

4:7.5.1~rc1-1

4:7.5.1~rc2-1

4:7.5.2~rc1-1

4:7.5.2~rc2-1

4:7.5.3~rc1-1

4:7.5.3~rc2-1

4:7.5.4~rc1-1

4:7.5.4~rc1-2

4:7.5.4~rc1-3

4:7.5.4~rc1-4

4:7.5.4~rc2-1

4:7.5.4-1

4:7.5.4-2

4:7.5.4-3

4:7.5.4-4

4:7.5.5~rc1-1

4:7.5.5~rc1-2

4:7.5.5~rc1-3

4:7.5.5~rc1-4

4:7.5.5~rc1-5

4:7.5.5~rc2-1

4:7.5.5-1

4:7.5.5-2

4:7.5.5-3~bpo12+1

4:7.5.5-3

4:7.5.5-4~bpo12+1

4:7.5.5-4

4:7.5.6-1~bpo12+1

4:7.5.6-1

4:7.5.7-1

4:7.5.8~rc1-1

4:7.5.8~rc1-2

4:7.5.8-1~bpo12+1

4:7.5.8-1

4:7.5.9~rc1-1~bpo12+1

4:7.5.9~rc1-1~bpo12+2

4:7.5.9~rc1-1

4:7.6.0~rc1-1

4:7.6.0~rc1-2

4:7.6.0~rc2-1

4:7.6.0~rc2-2

4:7.6.0~rc3-1

4:7.6.1~rc1-1

4:7.6.1~rc2-1

4:7.6.1~rc2-2

4:7.6.2-1

4:7.6.2-2

4:7.6.2-3

4:7.6.2-4

4:7.6.2-5

4:7.6.3~rc1-1

4:7.6.3~rc1-2

4:7.6.3~rc2-1

4:7.6.3~rc2-2

4:7.6.3-1

4:7.6.3-2

4:7.6.4~rc1-1~bpo12+1

4:7.6.4~rc1-1

4:24.*

4:24.2.0~alpha1-1

4:24.2.0~beta1-1

4:24.2.0~rc1-1

4:24.2.0~rc1-2

4:24.2.0~rc2-1

4:24.2.0~rc2-2~bpo12+1

4:24.2.0~rc2-2

4:24.2.0-1~bpo12+1

4:24.2.0-1

4:24.2.0-2

4:24.2.0-3

4:24.2.1~rc1-1

4:24.2.1~rc2-1

4:24.2.1-1

4:24.2.1-2

4:24.2.1-3

4:24.2.1-4

4:24.2.2~rc1-1

4:24.2.2~rc1-2

4:24.2.2~rc2-1

4:24.2.2~rc2-2

4:24.2.2-1

4:24.2.2-2

4:24.2.2-3

4:24.2.3~rc1-1

4:24.2.3~rc1-2

4:24.2.3~rc1-3

4:24.2.3~rc2-1

4:24.2.3-1~bpo12+1

4:24.2.3-1

4:24.2.3-2

4:24.2.4-1~bpo12+1

4:24.2.4-1

4:24.2.5-1~bpo12+1

4:24.2.5-1

4:24.2.5-2

4:24.2.5-3

4:24.2.5-4

4:24.2.6-1

4:24.2.6-2~bpo12+1

4:24.2.6-2

4:24.8.0~alpha1-1

4:24.8.0~alpha1-2

4:24.8.0~alpha1-3

4:24.8.0~alpha1-4

4:24.8.0~beta1-1

4:24.8.0~rc1-1

4:24.8.0~rc2-1

4:24.8.0~rc3-1

4:24.8.0~rc3-2

4:24.8.1~rc1-1

4:24.8.1-1

4:24.8.1-2

4:24.8.2~rc1-1

4:24.8.2-1~bpo12+1

4:24.8.2-1

4:24.8.2-2

4:24.8.3-1~bpo12+1

4:24.8.3-1

4:24.8.3-2

4:24.8.3-3

4:24.8.4-1~bpo12+1

4:24.8.4-1

4:24.8.4-2

4:24.8.4-3

4:24.8.4-4

4:24.8.5-1

4:24.8.5-2~bpo12+1

4:24.8.5-2~bpo12+2

4:24.8.5-2

4:25.*

4:25.2.0~alpha1-1

4:25.2.0~beta1-1

4:25.2.0~beta1-2

4:25.2.0~rc1-1

4:25.2.0~rc1-2

4:25.2.0~rc1-3

4:25.2.0~rc1-4

4:25.2.0~rc2-1

4:25.2.0~rc3-1

4:25.2.0~rc3-2

4:25.2.1~rc1-1

4:25.2.1~rc1-2

4:25.2.1~rc2-1

4:25.2.1-1

4:25.2.1-2

4:25.2.1-3~bpo12+1

4:25.2.1-3

4:25.2.2~rc1-1

4:25.2.2~rc2-1

4:25.2.2-1~bpo12+1

4:25.2.2-1

4:25.2.2-2

4:25.2.2-3~bpo12+1

4:25.2.2-3

4:25.2.3~rc1-1

4:25.2.3~rc1-2

4:25.2.3~rc2-1

4:25.2.3-1

4:25.2.3-2~bpo12+1

4:25.2.3-2

4:25.8.0~alpha1-1

4:25.8.0~alpha1-2

4:25.8.0~beta1-1

4:25.8.0~rc1-1

4:25.8.0~rc1-2

4:25.8.0~rc2-1

4:25.8.0~rc2-2

4:25.8.0~rc3-1

4:25.8.0~rc4-1

4:25.8.0~rc4-2

4:25.8.0-1~bpo13+1

4:25.8.0-1

4:25.8.1~rc1-1

4:25.8.1-1~bpo13+1

4:25.8.1-1

4:25.8.2~rc1-1

4:25.8.2~rc2-1

4:25.8.2-1

4:25.8.2-2

4:25.8.2-3~bpo13+1

4:25.8.2-3

4:25.8.3~rc1-1

4:25.8.3~rc2-1

4:25.8.3-1~bpo13+1

4:25.8.3-1

4:25.8.3-1+ports

4:25.8.4-1~bpo13+1

4:25.8.4-1

4:26.*

4:26.2.0~alpha1-1

4:26.2.0~alpha1-2

4:26.2.0~alpha1-3

4:26.2.0~beta1-1

4:26.2.0~rc1-1

4:26.2.0~rc2-1

4:26.2.0~rc3-1

4:26.2.0-1~bpo13+1

4:26.2.0-1

4:26.2.1~rc1-1

4:26.2.1~rc2-1

4:26.2.1-1~bpo13+1

4:26.2.1-1

4:26.2.2.1-1

4:26.2.2.1-2

4:26.2.2.2-1

4:26.2.2.2-2

4:26.2.2.2-3~bpo13+1

4:26.2.2.2-3

4:26.2.3.1-1

4:26.2.3.2-1

4:26.2.3.2-2~bpo13+1

4:26.2.3.2-2

4:26.2.4.1-1

4:26.2.4.2-1~bpo13+1

4:26.2.4.2-1

4:26.2.4.2-2

4:26.2.5.2-1

4:26.2.5.2-2~bpo13+1

4:26.2.5.2-2

4:26.8.0.0.alpha1-1

4:26.8.0.0.alpha1-2

4:26.8.0.0.alpha1-3

4:26.8.0.0.alpha1-4

4:26.8.0.0.beta1-1

4:26.8.0.1-1

4:26.8.0.2-1

4:26.8.0.3-1

4:26.8.0.3-2~bpo13+1

4:26.8.0.3-2

4:26.8.1.1-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63272.json"

Debian:13 / libreoffice

Package

Name: libreoffice
Purl: pkg:deb/debian/libreoffice?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4:25.*

4:25.2.3-2

4:25.2.3-2+deb13u1

4:25.2.3-2+deb13u2~bpo12+1

4:25.2.3-2+deb13u2

4:25.2.3-2+deb13u3~bpo12+1

4:25.2.3-2+deb13u3

4:25.2.3-2+deb13u4

4:25.2.3-2+deb13u5~bpo12+1

4:25.2.3-2+deb13u5

4:25.2.3-2+deb13u6

4:25.8.0~alpha1-1

4:25.8.0~alpha1-2

4:25.8.0~beta1-1

4:25.8.0~rc1-1

4:25.8.0~rc1-2

4:25.8.0~rc2-1

4:25.8.0~rc2-2

4:25.8.0~rc3-1

4:25.8.0~rc4-1

4:25.8.0~rc4-2

4:25.8.0-1~bpo13+1

4:25.8.0-1

4:25.8.1~rc1-1

4:25.8.1-1~bpo13+1

4:25.8.1-1

4:25.8.2~rc1-1

4:25.8.2~rc2-1

4:25.8.2-1

4:25.8.2-2

4:25.8.2-3~bpo13+1

4:25.8.2-3

4:25.8.3~rc1-1

4:25.8.3~rc2-1

4:25.8.3-1~bpo13+1

4:25.8.3-1

4:25.8.3-1+ports

4:25.8.4-1~bpo13+1

4:25.8.4-1

4:26.*

4:26.2.0~alpha1-1

4:26.2.0~alpha1-2

4:26.2.0~alpha1-3

4:26.2.0~beta1-1

4:26.2.0~rc1-1

4:26.2.0~rc2-1

4:26.2.0~rc3-1

4:26.2.0-1~bpo13+1

4:26.2.0-1

4:26.2.1~rc1-1

4:26.2.1~rc2-1

4:26.2.1-1~bpo13+1

4:26.2.1-1

4:26.2.2.1-1

4:26.2.2.1-2

4:26.2.2.2-1

4:26.2.2.2-2

4:26.2.2.2-3~bpo13+1

4:26.2.2.2-3

4:26.2.3.1-1

4:26.2.3.2-1

4:26.2.3.2-2~bpo13+1

4:26.2.3.2-2

4:26.2.4.1-1

4:26.2.4.2-1~bpo13+1

4:26.2.4.2-1

4:26.2.4.2-2

4:26.2.5.2-1

4:26.2.5.2-2~bpo13+1

4:26.2.5.2-2

4:26.8.0.0.alpha1-1

4:26.8.0.0.alpha1-2

4:26.8.0.0.alpha1-3

4:26.8.0.0.alpha1-4

4:26.8.0.0.beta1-1

4:26.8.0.1-1

4:26.8.0.2-1

4:26.8.0.3-1

4:26.8.0.3-2~bpo13+1

4:26.8.0.3-2

4:26.8.1.1-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63272.json"

Debian:14 / libreoffice

Package

Name: libreoffice
Purl: pkg:deb/debian/libreoffice?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4:26.2.5.2-1

Affected versions

4:25.*

4:25.2.3-2

4:25.8.0~alpha1-1

4:25.8.0~alpha1-2

4:25.8.0~beta1-1

4:25.8.0~rc1-1

4:25.8.0~rc1-2

4:25.8.0~rc2-1

4:25.8.0~rc2-2

4:25.8.0~rc3-1

4:25.8.0~rc4-1

4:25.8.0~rc4-2

4:25.8.0-1~bpo13+1

4:25.8.0-1

4:25.8.1~rc1-1

4:25.8.1-1~bpo13+1

4:25.8.1-1

4:25.8.2~rc1-1

4:25.8.2~rc2-1

4:25.8.2-1

4:25.8.2-2

4:25.8.2-3~bpo13+1

4:25.8.2-3

4:25.8.3~rc1-1

4:25.8.3~rc2-1

4:25.8.3-1~bpo13+1

4:25.8.3-1

4:25.8.3-1+ports

4:25.8.4-1~bpo13+1

4:25.8.4-1

4:26.*

4:26.2.0~alpha1-1

4:26.2.0~alpha1-2

4:26.2.0~alpha1-3

4:26.2.0~beta1-1

4:26.2.0~rc1-1

4:26.2.0~rc2-1

4:26.2.0~rc3-1

4:26.2.0-1~bpo13+1

4:26.2.0-1

4:26.2.1~rc1-1

4:26.2.1~rc2-1

4:26.2.1-1~bpo13+1

4:26.2.1-1

4:26.2.2.1-1

4:26.2.2.1-2

4:26.2.2.2-1

4:26.2.2.2-2

4:26.2.2.2-3~bpo13+1

4:26.2.2.2-3

4:26.2.3.1-1

4:26.2.3.2-1

4:26.2.3.2-2~bpo13+1

4:26.2.3.2-2

4:26.2.4.1-1

4:26.2.4.2-1~bpo13+1

4:26.2.4.2-1

4:26.2.4.2-2

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63272.json"