Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-63272

Heap buffer overflow in WMF text record import

CVSS 4.0 5.4 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-63272

Published

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-63272

Published

LibreOffice

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "The Document Foundation",
                    "product": "LibreOffice",
                    "defaultStatus": "unknown",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "26.2",
                            "lessThan": "< 26.2.5",
                            "versionType": "26.2 series"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON