LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette. In fixed versions the palette index is limited to the entries present.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8868-1 advisory.

    It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use     this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code.
    (CVE-2026-63272)

    It was discovered that LibreOffice incorrectly handled PDF document imports. An attacker could possibly     use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code.
    (CVE-2026-63273, CVE-2026-63274)

    It was discovered that LibreOffice incorrectly handled CFF fonts embedded in documents. An attacker could     possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute     arbitrary code. (CVE-2026-63275, CVE-2026-63276)

    It was discovered that LibreOffice incorrectly validated package URLs. An attacker could possibly use this     issue to obtain sensitive information. (CVE-2026-63278)

    It was discovered that LibreOffice incorrectly handled PICT image imports. An attacker could possibly use     this issue to cause LibreOffice to crash, resulting in a denial of service, or obtain sensitive     information. (CVE-2026-63279)

    It was discovered that LibreOffice incorrectly mitigated out-of-bounds writes via Graphite font actions.
    An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service,     or execute arbitrary code. (CVE-2026-50593)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of LibreOffice installed on the remote host is prior to 26.2.5. It is, therefore, affected by multiple vulnerabilities:

  - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted     document. The length of the decryption key was taken from the document's own encryption dictionary and was     used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer     wrote past its end. (CVE-2026-63273)

  - LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported     to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The     converted operators were written into a fixed size buffer with no check that they still fit, so a glyph     emitting many operators wrote past the end of the buffer. (CVE-2026-63276)

  - LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when     importing a text record that carries its own character advance widths. The count of advance values and the     length of the text were read separately from the file and were not required to agree, so drawing the text     walked the advance array by character position and ran past its end when the array was the shorter of the     two. (CVE-2026-63272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6512 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6512-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 24, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libreoffice     CVE ID         : CVE-2024-12426 CVE-2026-63272 CVE-2026-63273 CVE-2026-63274                      CVE-2026-63275 CVE-2026-63276 CVE-2026-63278 CVE-2026-63279

    Multiple security vulnerabilities were discovered in LibreOffice, which     could result in denial of service, information disclosure or potentially     the execution of arbitrary code if malformed document files are opened.

    For the stable distribution (trixie), these problems have been fixed in     version 4:25.2.3-2+deb13u7.

    We recommend that you upgrade your libreoffice packages.

    For the detailed security status of libreoffice please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libreoffice

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when     importing an image that uses a colour palette. The palette index held in the image data was used without     being checked against the number of entries the palette has, so an index past the last entry read memory     outside the palette. In fixed versions the palette index is limited to the entries present.
    (CVE-2026-63279)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
363108	Ubuntu 22.04 LTS / 24.04 LTS : LibreOffice vulnerabilities (USN-8868-1)	Nessus	Ubuntu Local Security Checks	Local	medium
350094	LibreOffice < 26.2.5 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
349793	Debian dsa-6512 : fonts-opensymbol - security update	Nessus	Debian Local Security Checks	Local	medium
349169	Linux Distros Unpatched Vulnerability : CVE-2026-63279	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-63279

medium

Tenable Plugins

medium

medium

medium

medium