libreoffice: stack buffer overflow in CFF font hint handling

A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

Learning-History-of-CFF-bug-in-iphone

Learning-History-of-CFF-bug-in-iphone Dive into CFF font and coincidently learn about a bof in cff parsing from some jailbreak. just for fun So.... wtf is CFF ? So from my knowledge it's a file format , but let's try to understad what wikipedia says:"CFF acts as a container to store multiple font...

ANT-2026-RNHRV8B9 · LibreOffice/core · Stack Buffer Overflow / Off-by-N

stack-buffer-overflow medium CVE-2026-63275 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-RNHRV8B9: CFF hint-stack bound...

CVE-2026-63275

A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

CVE-2026-63275

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

DEBIAN-CVE-2026-63275

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

CVE-2026-63276

CVE-2026-63276 is a stack buffer overflow in LibreOffice 's CFF-to-Type 1 font conversion, which occurs when the application subsets fonts during PDF export. A glyph that emits many operators writes past the end of a fixed-size buffer with no bounds check. In fixed versions, remaining capacity is...

EUVD-2026-84355

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

CVE-2026-63275

LibreOffice is vulnerable to a stack buffer overflow when processing CFF fonts embedded in documents. The root cause is a bounds-checking error: the number of glyph hints was validated against the wrong limit, allowing a crafted glyph to declare more hints than the stack array could hold and writ...

CVE-2026-63275 Stack buffer overflow in CFF font hint handling

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

poppler:pdf_draw_fuzzer: Heap-buffer-overflow in _cairo_array_append_multiple

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed Report: https://oss-fuzz.com/testcase?key=4960562293637120 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target:...

ghostscript:gstoraster_pdf_fuzzer: Heap-buffer-overflow in uofs

Detailed Report: https://oss-fuzz.com/testcase?key=4897049582370816 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterpdffuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62d000058458 Crash State: uofs...

PT-2023-35761 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves functions such as pdfi read cff font, pdfi load font buffer, and pdfi load...

ghostscript:gs_device_psdcmyk_fuzzer: Crash in pdfi_read_cff_font

Detailed Report: https://oss-fuzz.com/testcase?key=5553984474841088 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdevicepsdcmykfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x6311000ab8c8 Crash State: pdfireadcfffont...

SUSE CVE-2010-3311

Integer overflow in base/ftstream.c in libXft aka the X FreeType library in FreeType before 2.4 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted Compact Font Format CFF font file that triggers a heap-based buffer overflow,...

ghostscript:gs_device_ps2write_fuzzer: Heap-buffer-overflow in pdfi_read_cff_dict

Detailed Report: https://oss-fuzz.com/testcase?key=5610170981416960 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdeviceps2writefuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62d000076e10 Crash State:...

(Pwn2Own) HP LaserJet Pro MFP M283fdw CFF Font Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of HP LaserJet Pro MFP M283fdw printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PostScript interpreter. Crafted data in a CFF font can...

PT-2022-36861

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions: pdfi read cff font, pdfi load font, and pdfi read type0...

ghostscript:gstoraster_fuzzer: Crash in pdfi_read_cff_font

Detailed Report: https://oss-fuzz.com/testcase?key=6111748510318592 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x62d1000be438 Crash State: pdfireadcfffont pdfiloadfont...

PT-2022-36857

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash occurred due to an unknown read issue. The crash state indicates a problem with loading a font, specifically involving the functions pdfi count cff...