CVE-2026-63275CWE-787

CVE-2026-63275

published September 22, 2026

CVSS
5.4
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.

The record
Technical detail
CVSS
5.4 · NONE
CVSS v4.0
5.4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00187 · 7.8th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-09-22T16:17Z
References (1)
https://www.libreoffice.org/about-us/security/advisories/cve-2026-63275 · [email protected]
EPSS history
Timeline
  • 24 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 22 SEP 11:10Z
    Stack buffer overflow in CFF font hint handling
    cvelistv5