Bug 2538363 (CVE-2026-63275) - CVE-2026-63275 libreoffice: stack buffer overflow in CFF font hint handling
Summary: CVE-2026-63275 libreoffice: stack buffer overflow in CFF font hint handling
Keywords:
Status: NEW
Alias: CVE-2026-63275
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2540067
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-22 18:17 UTC by OSIDB Bzimport
Modified: 2026-09-24 13:47 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-22 18:17:20 UTC 
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.
Note You need to log in before you can comment on or make changes to this bug.