Reported by 2 outlets
CVE-2026-63278 affects LibreOffice from The Document Foundation. Crafted document links could expand environment variable or INI file values
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 3.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.13 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The Document Foundation's advisory batch for LibreOffice lists CVE-2026-63278 as affecting the application, with crafted document links able to expand environment variable or INI file values. The vendor advisory also notes CVE-2026-63274 (heap buffer overflow in PDF import stream handling), CVE-2026-63275 (stack buffer overflow in CFF font hint handling), and CVE-2026-63276 (stack buffer overflow in CFF to Type 1 conversion during PDF export), all fixed in LibreOffice 26.2.5. The 63274-63275 findings were made by Anthropic using agents, validated by Ada Logics. Secondary reports incorrectly describe the bugs as unpatched; the advisory confirms fixes in 26.2.5 and recommends upgrading.
Timeline
-
original reporting
CVE-2026-63278 affects LibreOffice from The Document Foundation. Crafted document links could expand environment variable or INI file values
www.libreoffice.org · 21d ago · September 22nd, 2026
CVE-2026-63278 affects LibreOffice from The Document Foundation. Crafted document links could expand environment variable or INI file values
via Mastodon https://www.libreoffice.org/about-us/security/advisories/CVE-2026-63278
-
update from libreoffice.org
Same 26.2.5 advisory batch already fixes companion bugs CVE-2026-63274, CVE-2026-63275 and CVE-2026-63276
libreoffice.org · 23d ago · September 21st, 2026
The vendor advisory batch announced September 21, 2026 lists CVE-2026-63274 (heap buffer overflow in PDF import stream handling in LibreOffice Draw), CVE-2026-63275 (stack buffer overflow in CFF font hint handling) and CVE-2026-63276 (stack buffer overflow in CFF to Type 1 font conversion during PDF export) as all fixed in LibreOffice 26.2.5. The advisory recommends all users upgrade to 26.2.5 or later. This contradicts later secondary reports describing those three bugs as unpatched with unknown fix status. The 63273/63274/63275 findings were made by Anthropic using agents studying open source security, with Ada Logics validating and reporting.
-
update from www.valtersit.com
CVE-2026-63276 LibreOffice stack buffer overflow, CVSS 7.8, triggered by exporting a malicious document to PDF. No patch yet. Avoid untruste
www.valtersit.com · 10d ago · October 3rd, 2026
CVE-2026-63276 LibreOffice stack buffer overflow, CVSS 7.8, triggered by exporting a malicious document to PDF. No patch yet. Avoid untruste
via Mastodon https://www.valtersit.com/cve/CVE-2026-63276/
-
update from www.valtersit.com
CVE-2026-63278: info disclosure via crafted URLs that expand env or INI values, leaking secrets to remote servers. Incomplete fix for CVE-20
www.valtersit.com · 10d ago · October 3rd, 2026
CVE-2026-63278: info disclosure via crafted URLs that expand env or INI values, leaking secrets to remote servers.
-
mentioned by www.valtersit.com
CVE-2026-63275 stack buffer overflow in LibreOffice CFF font glyph hint parsing. Open a malicious document, get code execution. No CVSS or p
www.valtersit.com · 10d ago · October 3rd, 2026
-
mentioned by www.valtersit.com
CVE-2026-63274 LibreOffice Draw heap buffer overflow on PDF import, no CVSS, patch status unknown. Opening a crafted PDF can corrupt memory.
www.valtersit.com · 10d ago · October 3rd, 2026