Learning-History-of-CFF-bug-in-iphone

Learning-History-of-CFF-bug-in-iphone Dive into CFF font and coincidently learn about a bof in cff parsing from some jailbreak. just for fun So.... wtf is CFF ? So from my knowledge it's a file format , but let's try to understad what wikipedia says:"CFF acts as a container to store multiple font...

Important: Red Hat Security Advisory: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

An update for multiple packages is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

libreoffice: stack buffer overflow in CFF font hint handling

A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

RHEL 9 : libreoffice (RHSA-2026:82013)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82013 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processo...

MiracleLinux 9 : libreoffice-7.1.8.1-15.el9_8.3.ML.1 (AXSA:2026-2082:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2082:05 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

RockyLinux 9 : libreoffice (RLSA-2026:82013)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82013 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

Oracle Linux 9 : libreoffice (ELSA-2026-82013)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-82013 advisory. - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow...

libreoffice: stack buffer overflow in CFF font hint handling

A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

ANT-2026-RNHRV8B9 · LibreOffice/core · Stack Buffer Overflow / Off-by-N

stack-buffer-overflow medium CVE-2026-63275 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-RNHRV8B9: CFF hint-stack bound...

CVE-2026-63275

A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

CVE-2026-63275

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

DEBIAN-CVE-2026-63275

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

CVE-2026-63276

CVE-2026-63276 is a stack buffer overflow in LibreOffice 's CFF-to-Type 1 font conversion, which occurs when the application subsets fonts during PDF export. A glyph that emits many operators writes past the end of a fixed-size buffer with no bounds check. In fixed versions, remaining capacity is...

CVE-2026-63275 Stack buffer overflow in CFF font hint handling

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

EUVD-2026-84355

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

CVE-2026-63275

LibreOffice is vulnerable to a stack buffer overflow when processing CFF fonts embedded in documents. The root cause is a bounds-checking error: the number of glyph hints was validated against the wrong limit, allowing a crafted glyph to declare more hints than the stack array could hold and writ...

poppler:pdf_draw_fuzzer: Heap-buffer-overflow in _cairo_array_append_multiple

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed Report: https://oss-fuzz.com/testcase?key=4960562293637120 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target:...

ghostscript:gstoraster_pdf_fuzzer: Heap-buffer-overflow in uofs

Detailed Report: https://oss-fuzz.com/testcase?key=4897049582370816 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterpdffuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62d000058458 Crash State: uofs...

PT-2023-35761 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves functions such as pdfi read cff font, pdfi load font buffer, and pdfi load...

ghostscript:gs_device_psdcmyk_fuzzer: Crash in pdfi_read_cff_font

Detailed Report: https://oss-fuzz.com/testcase?key=5553984474841088 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdevicepsdcmykfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x6311000ab8c8 Crash State: pdfireadcfffont...