LibreOffice PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

October 16th, 2026
ZDI-26-782 ZDI-CAN-31075

CVE ID

CVE-2026-63274

CVSS Score

7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Vendors

LibreOffice

Affected Products

LibreOffice

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Additional Details

LibreOffice has issued an update to correct this vulnerability. More details can be found at:
https://www.libreoffice.org/security/#cve-2026-63274

Disclosure Timeline

  • 2026-07-03 - Vulnerability reported to vendor
  • 2026-10-16 - Coordinated public release of advisory
  • 2026-10-16 - Advisory Updated

Credit

Anonymous

Back to Advisories