CVE-2026-63279

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63279", "assignerOrgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "state": "PUBLISHED", "assignerShortName": "Document Fdn.", "dateReserved": "2026-07-16T08:17:05.512Z", "datePublished": "2026-09-22T11:10:41.707Z", "dateUpdated": "2026-09-22T12:16:55.755Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "shortName": "Document Fdn.", "dateUpdated": "2026-09-22T11:10:41.707Z"}, "title": "Out of bounds read in PICT image import", "datePublic": "2026-09-21T23:59:00.000Z", "descriptions": [{"lang": "en", "value": "LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>LibreOffice can import PICT images, which may be embedded in documents.</p><p>An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette.</p><p>In fixed versions the palette index is limited to the entries present.</p>"}]}], "affected": [{"vendor": "The Document Foundation", "product": "LibreOffice", "defaultStatus": "unknown", "versions": [{"status": "affected", "version": "26.2", "lessThan": "< 26.2.5", "versionType": "26.2 series"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Himanshu Anand"}, {"lang": "en", "type": "remediation developer", "value": "Caol\u00e1n McNamara of Collabora Productivity"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-44", "descriptions": [{"lang": "en", "value": "CAPEC-44 Overflow Binary Resource File"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"}}], "references": [{"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-63279"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-22T12:08:30.662496Z", "id": "CVE-2026-63279", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T12:16:55.755Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63279", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-22T12:08:30.662496Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T12:12:07.679Z"}}], "cna": {"title": "Out of bounds read in PICT image import", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Himanshu Anand"}, {"lang": "en", "type": "remediation developer", "value": "Caol\u00e1n McNamara of Collabora Productivity"}], "impacts": [{"capecId": "CAPEC-44", "descriptions": [{"lang": "en", "value": "CAPEC-44 Overflow Binary Resource File"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Document Foundation", "product": "LibreOffice", "versions": [{"status": "affected", "version": "26.2", "lessThan": "< 26.2.5", "versionType": "26.2 series"}], "defaultStatus": "unknown"}], "datePublic": "2026-09-21T23:59:00.000Z", "references": [{"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-63279"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.", "supportingMedia": [{"type": "text/html", "value": "<p>LibreOffice can import PICT images, which may be embedded in documents.</p><p>An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette.</p><p>In fixed versions the palette index is limited to the entries present.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "shortName": "Document Fdn.", "dateUpdated": "2026-09-22T11:10:41.707Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63279", "state": "PUBLISHED", "dateUpdated": "2026-09-22T12:16:55.755Z", "dateReserved": "2026-07-16T08:17:05.512Z", "assignerOrgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "datePublished": "2026-09-22T11:10:41.707Z", "assignerShortName": "Document Fdn."}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "LibreOffice", "vendor": "The Document Foundation", "versions": [{"lessThan": "< 26.2.5", "status": "affected", "version": "26.2", "versionType": "26.2 series"}]}], "source": "security@documentfoundation.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present."}], "id": "CVE-2026-63279", "lastModified": "2026-09-22T19:09:32.273", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@documentfoundation.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63279", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-22T12:08:30.662496Z", "version": "2.0.3"}}]}, "published": "2026-09-22T12:17:13.850", "references": [{"source": "security@documentfoundation.org", "url": "https://www.libreoffice.org/about-us/security/advisories/cve-2026-63279"}], "sourceIdentifier": "security@documentfoundation.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security@documentfoundation.org", "type": "Secondary"}]}

{"bugzilla": {"description": "libreoffice: LibreOffice: Information disclosure and denial of service via out-of-bounds read in PICT image import", "id": "2538152", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538152"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in LibreOffice. When importing a specially crafted PICT image embedded in a document, an out-of-bounds read vulnerability exists. This occurs because the palette index in the image data is not validated against the actual size of the color palette. A remote attacker could exploit this to read memory outside the intended buffer, potentially leading to information disclosure or a denial of service."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, users should avoid opening untrusted documents or documents from unknown sources in LibreOffice. This operational control reduces the risk of triggering the out-of-bounds read vulnerability."}, "name": "CVE-2026-63279", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "libreoffice", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "libreoffice", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "libreoffice", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "libreoffice", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-22T11:10:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63279\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63279\nhttps://www.libreoffice.org/about-us/security/advisories/cve-2026-63279"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[26.2,26.2.5)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 81.0, "source": "matching"}]}, "original": {"product": "LibreOffice", "source": "cna", "vendor": "The Document Foundation"}, "product": "libreoffice", "vendor": "the_document_foundation"}], "created": "2026-09-22T12:30:07.844357+00:00", "updated": "2026-09-22T19:15:11.347576+00:00", "vendors": ["the_document_foundation", "the_document_foundation$PRODUCT$libreoffice"]}