LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.

The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2LIBREOFFICE-2026-010 advisory.

    LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted     document. The length of the decryption key was taken from the document's own encryption dictionary and was     used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer     wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.
    (CVE-2026-63273)

    LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when     reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph     declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is     checked against the capacity the array really has. (CVE-2026-63275)

    LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported     to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion.
    The converted operators were written into a fixed size buffer with no check that they still fit, so a     glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity     is tracked and the conversion stops when it is used up. (CVE-2026-63276)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8868-1 advisory.

    It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use     this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code.
    (CVE-2026-63272)

    It was discovered that LibreOffice incorrectly handled PDF document imports. An attacker could possibly     use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code.
    (CVE-2026-63273, CVE-2026-63274)

    It was discovered that LibreOffice incorrectly handled CFF fonts embedded in documents. An attacker could     possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute     arbitrary code. (CVE-2026-63275, CVE-2026-63276)

    It was discovered that LibreOffice incorrectly validated package URLs. An attacker could possibly use this     issue to obtain sensitive information. (CVE-2026-63278)

    It was discovered that LibreOffice incorrectly handled PICT image imports. An attacker could possibly use     this issue to cause LibreOffice to crash, resulting in a denial of service, or obtain sensitive     information. (CVE-2026-63279)

    It was discovered that LibreOffice incorrectly mitigated out-of-bounds writes via Graphite font actions.
    An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service,     or execute arbitrary code. (CVE-2026-50593)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of LibreOffice installed on the remote host is prior to 26.2.5. It is, therefore, affected by multiple vulnerabilities:

  - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted     document. The length of the decryption key was taken from the document's own encryption dictionary and was     used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer     wrote past its end. (CVE-2026-63273)

  - LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported     to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The     converted operators were written into a fixed size buffer with no check that they still fit, so a glyph     emitting many operators wrote past the end of the buffer. (CVE-2026-63276)

  - LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when     importing a text record that carries its own character advance widths. The count of advance values and the     length of the text were read separately from the file and were not required to agree, so drawing the text     walked the advance array by character position and ran past its end when the array was the shorter of the     two. (CVE-2026-63272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6512 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6512-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 24, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libreoffice     CVE ID         : CVE-2024-12426 CVE-2026-63272 CVE-2026-63273 CVE-2026-63274                      CVE-2026-63275 CVE-2026-63276 CVE-2026-63278 CVE-2026-63279

    Multiple security vulnerabilities were discovered in LibreOffice, which     could result in denial of service, information disclosure or potentially     the execution of arbitrary code if malformed document files are opened.

    For the stable distribution (trixie), these problems have been fixed in     version 4:25.2.3-2+deb13u7.

    We recommend that you upgrade your libreoffice packages.

    For the detailed security status of libreoffice please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libreoffice

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted     document. The length of the decryption key was taken from the document's own encryption dictionary and was     used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer     wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.
    (CVE-2026-63273)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365272	Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2026-010)	Nessus	Amazon Linux Local Security Checks	Local	medium
363108	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : LibreOffice vulnerabilities (USN-8868-1)	Nessus	Ubuntu Local Security Checks	Local	medium
350094	LibreOffice < 26.2.5 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
349793	Debian dsa-6512 : fonts-opensymbol - security update	Nessus	Debian Local Security Checks	Local	medium
349151	Linux Distros Unpatched Vulnerability : CVE-2026-63273	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-63273

medium

Tenable Plugins

medium

medium

medium

medium

medium