Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-63278

Package URLs can be used to exfiltrate arbitrary INI file values and environment variables

CVSS 4.0 6.7 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-63278

Published

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-63278

Published

LibreOffice

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "The Document Foundation",
                    "product": "LibreOffice",
                    "defaultStatus": "unknown",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "26.2",
                            "lessThan": "< 26.2.5",
                            "versionType": "26.2 series"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON