CVE-2026-104067

A flaw was found in Scribus. This vulnerability can lead to arbitrary code execution or a Denial of Service DoS due to an application crash. The StarView Metafile SVM import plugin fails to verify that bitmap and transparency mask dimensions match when processing files. An attacker could exploit...

Red Hat: CVE-2026-96644: pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

PT-2026-116665

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system where the hidden space calculation in the xfs metafile resv init function can underflow. This occurs if the amount of fdblocks file system blocks...

USN-8534-1 libreoffice vulnerabilities

It was discovered that LibreOffice incorrectly handled importing DXF drawings. An attacker could use this issue to cause LibreOffice to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2026-6039 It was discovered that LibreOffice incorrectly handled certain ODF...

SUSE CVE-2026-6045

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small...

CVE-2026-6045 Heap buffer overflow in EMF+ gradient brush import

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small...

EUVD-2026-36736

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small...

CVE-2026-6045 Heap buffer overflow in EMF+ gradient brush import

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small...

PT-2026-49264

Name of the Vulnerable Software and Affected Versions LibreOffice affected versions not specified Description A heap buffer overflow occurs during the import of EMF+ graphics, which can be embedded in documents. Specifically, the issue arises when importing an EMF+ gradient brush. The software...

CVE-2026-6045

LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: libEMF (UTSA-2026-016701)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016701 advisory. libEMF aka ECMA-234 Metafile Library through 1.0.11 allows denial of service issue 1 of 2. Tenable has extracted the preceding description block directly from the...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: libEMF (UTSA-2026-016697)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016697 advisory. ScaleViewPortExtEx in libemf.cpp in libEMF aka ECMA-234 Metafile Library 1.0.12 allows an integer overflow and denial of service via a crafted EMF file. Tenable has...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: libEMF (UTSA-2026-016698)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016698 advisory. libEMF aka ECMA-234 Metafile Library through 1.0.11 allows a use-after-free. Tenable has extracted the preceding description block directly from the Unity Linux...

Windows GDI Disclosure

The vulnerability of the Windows GDI component in Windows operating systems is related to the execution of operations beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to disclose sensitive information using a specially created file with the EMF extension...

CVE-2025-58427

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information...

CVE-2025-64776

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information...

CVE-2025-64733

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information...

CVE-2025-64735

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information...

CVE-2025-66617

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information...

CVE-2025-66000

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information...