CVE-2026-63275

A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

CVE-2026-63275

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

CVE-2026-63275

LibreOffice is vulnerable to a stack buffer overflow when processing CFF fonts embedded in documents. The root cause is a bounds-checking error: the number of glyph hints was validated against the wrong limit, allowing a crafted glyph to declare more hints than the stack array could hold and writ...