LibreOffice < 26.2.5 Multiple Vulnerabilities

critical Nessus Plugin ID 350094

Synopsis

An application installed on the remote host is affected by multiple vulnerabilities.

Description

The version of LibreOffice installed on the remote host is prior to 26.2.5. It is, therefore, affected by multiple vulnerabilities:

- LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. (CVE-2026-63273)

- LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. (CVE-2026-63276)

- LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. (CVE-2026-63272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to LibreOffice version 26.2.5 or later.

Plugin Details

Severity: Critical

ID: 350094

File Name: libreoffice_26_2_5.nasl

Version: 1.2

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 9/25/2026

Updated: 9/25/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.32

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-63273

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:libreoffice:libreoffice

Required KB Items: installed_sw/LibreOffice

Patch Publication Date: 9/21/2026

Vulnerability Publication Date: 9/21/2026

Reference Information

CVE: CVE-2026-63272, CVE-2026-63273, CVE-2026-63274, CVE-2026-63275, CVE-2026-63276, CVE-2026-63278, CVE-2026-63279

IAVB: 2026-B-0272

Detections

Analytics