Heap buffer overflow in PDF import stream handling
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
CVE-2026-63274
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-63274
LibreOffice
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "The Document Foundation",
"product": "LibreOffice",
"versions": [
{
"status": "affected",
"version": "26.2",
"lessThan": "< 26.2.5",
"versionType": "26.2 series"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-63274
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #3135 · Revision 1
- Added to Heist Feed
- Publisher date