Important: Red Hat Security Advisory: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

An update for multiple packages is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

libreoffice: stack buffer overflow in CFF to Type 1 font conversion

A flaw was found in LibreOffice. When a user exports a document with crafted embedded fonts to PDF, a stack-based buffer overflow can occur during the conversion of CFF fonts to Type 1 fonts due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

RHEL 9 : libreoffice (RHSA-2026:82013)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82013 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processo...

RockyLinux 9 : libreoffice (RLSA-2026:82013)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82013 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

libreoffice: stack buffer overflow in CFF to Type 1 font conversion

A flaw was found in LibreOffice. When a user exports a document with crafted embedded fonts to PDF, a stack-based buffer overflow can occur during the conversion of CFF fonts to Type 1 fonts due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

CVE-2026-63276 Stack buffer overflow in CFF to Type 1 font conversion

LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they...

CVE-2026-63276

CVE-2026-63276 is a stack buffer overflow in LibreOffice 's CFF-to-Type 1 font conversion, which occurs when the application subsets fonts during PDF export. A glyph that emits many operators writes past the end of a fixed-size buffer with no bounds check. In fixed versions, remaining capacity is...

CVE-2026-54060

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile assembled per-glyph images into a combined bitmap with Image.new"1", xsize, ysize without calling Image.decompressionbombcheck, allowing a font to trigger excessive allocation during conversion or saving. This...

PYSEC-2026-2254

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile assembled per-glyph images into a combined bitmap with Image.new"1", xsize, ysize without calling Image.decompressionbombcheck, allowing a font to trigger excessive allocation during conversion or saving. This...

CVE-2026-54060

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile assembled per-glyph images into a combined bitmap with Image.new"1", xsize, ysize without calling Image.decompressionbombcheck, allowing a font to trigger excessive allocation during conversion or saving. This...

libreoffice:sftfuzzer: Crash in vcl::ConvertCFFfontToType1

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=4679121702813696 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: sftfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

CVE-2025-47868

Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part of Apache NuttX RTOS repository. This standalone program is optional and neither part of NuttX RTOS nor Applications runtime, but active...

CVE-2025-47868 Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition.

Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part of Apache NuttX RTOS repository. This standalone program is optional and neither part of NuttX RTOS nor Applications runtime, but active...

CVE-2025-47868: Out-of-bounds Write

Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part of Apache NuttX RTOS repository. This standalone program is optional and neither part of NuttX RTOS nor Applications runtime, but active...

woff2:convert_woff2ttf_fuzzer_new_entry: Use-of-uninitialized-value in convert_woff2ttf_fuzzer_new_entry.cc

Project: https://github.com/google/woff2.git Detailed Report: https://oss-fuzz.com/testcase?key=4701552385261568 Project: woff2 Fuzzing Engine: libFuzzer Fuzz Target: convertwoff2ttffuzzernewentry Job Type: libfuzzermsanwoff2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address...

CVE-2022-29777

Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h...

CVE-2017-12103

An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font into a curve. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context ...

CVE-2004-0901

Microsoft Word for Windows 6.0 Converter MSWRD632.WPC, as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different...

CVE-2004-0901

Microsoft Word for Windows 6.0 Converter MSWRD632.WPC, as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different...

CVE-2004-0901

CVE-2004-0901 (Font Conversion Vulnerability) affects WordPad’s Word for Windows 6.0 Converter (MSWRD632.WPC) used by WordPad. A crafted Word/RTF/WRI/ DOC file can trigger a buffer/length-check flaw, leading to remote code execution when opened by WordPad. Public advisories (MS04-041) document tw...