LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.

redhat RHSA-2026:82013: RHSA-2026:82013: libreoffice security update (Important)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-82013 advisory.

    - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import       stream handling
    - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint       handling
    - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1       font conversion

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82013 advisory.

    * libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274)

    * libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276)

    * libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275)

    * libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2LIBREOFFICE-2026-010 advisory.

    LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted     document. The length of the decryption key was taken from the document's own encryption dictionary and was     used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer     wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.
    (CVE-2026-63273)

    LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when     reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph     declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is     checked against the capacity the array really has. (CVE-2026-63275)

    LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported     to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion.
    The converted operators were written into a fixed size buffer with no check that they still fit, so a     glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity     is tracked and the conversion stops when it is used up. (CVE-2026-63276)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8868-1 advisory.

    It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use     this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code.
    (CVE-2026-63272)

    It was discovered that LibreOffice incorrectly handled PDF document imports. An attacker could possibly     use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code.
    (CVE-2026-63273, CVE-2026-63274)

    It was discovered that LibreOffice incorrectly handled CFF fonts embedded in documents. An attacker could     possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute     arbitrary code. (CVE-2026-63275, CVE-2026-63276)

    It was discovered that LibreOffice incorrectly validated package URLs. An attacker could possibly use this     issue to obtain sensitive information. (CVE-2026-63278)

    It was discovered that LibreOffice incorrectly handled PICT image imports. An attacker could possibly use     this issue to cause LibreOffice to crash, resulting in a denial of service, or obtain sensitive     information. (CVE-2026-63279)

    It was discovered that LibreOffice incorrectly mitigated out-of-bounds writes via Graphite font actions.
    An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service,     or execute arbitrary code. (CVE-2026-50593)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of LibreOffice installed on the remote host is prior to 26.2.5. It is, therefore, affected by multiple vulnerabilities:

  - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted     document. The length of the decryption key was taken from the document's own encryption dictionary and was     used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer     wrote past its end. (CVE-2026-63273)

  - LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported     to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The     converted operators were written into a fixed size buffer with no check that they still fit, so a glyph     emitting many operators wrote past the end of the buffer. (CVE-2026-63276)

  - LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when     importing a text record that carries its own character advance widths. The count of advance values and the     length of the text were read separately from the file and were not required to agree, so drawing the text     walked the advance array by character position and ran past its end when the array was the shorter of the     two. (CVE-2026-63272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6512 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6512-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 24, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libreoffice     CVE ID         : CVE-2024-12426 CVE-2026-63272 CVE-2026-63273 CVE-2026-63274                      CVE-2026-63275 CVE-2026-63276 CVE-2026-63278 CVE-2026-63279

    Multiple security vulnerabilities were discovered in LibreOffice, which     could result in denial of service, information disclosure or potentially     the execution of arbitrary code if malformed document files are opened.

    For the stable distribution (trixie), these problems have been fixed in     version 4:25.2.3-2+deb13u7.

    We recommend that you upgrade your libreoffice packages.

    For the detailed security status of libreoffice please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libreoffice

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when     reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph     declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is     checked against the capacity the array really has. (CVE-2026-63275)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365560	Oracle Linux 9 : libreoffice (ELSA-2026-82013)	Nessus	Oracle Linux Local Security Checks	Local	high
365538	RockyLinux 9 : libreoffice (RLSA-2026:82013)	Nessus	Rocky Linux Local Security Checks	Local	high
365272	Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2026-010)	Nessus	Amazon Linux Local Security Checks	Local	medium
363108	Ubuntu 22.04 LTS / 24.04 LTS : LibreOffice vulnerabilities (USN-8868-1)	Nessus	Ubuntu Local Security Checks	Local	medium
350094	LibreOffice < 26.2.5 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
349793	Debian dsa-6512 : fonts-opensymbol - security update	Nessus	Debian Local Security Checks	Local	medium
349170	Linux Distros Unpatched Vulnerability : CVE-2026-63275	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-63275

medium

Tenable Plugins

Coming Soon

high

high

medium

medium

medium

medium

medium