CVE-2026-63269 LFI and GET SSRF via GStreamer and HLS playlists
Attackers can exploit LibreOffice on Linux to read local files and access remote URLs via malicious HLS playlists in linked media.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-63269?
CVE-2026-63269 is a medium-severity server-side request forgery vulnerability in The Document Foundation LibreOffice, published on 5 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.
Which versions are affected by CVE-2026-63269?
How do I fix CVE-2026-63269?
Apply the vendor's patch.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-63269 being exploited?
There is no known exploitation of CVE-2026-63269 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-63269, ECHO-8539-27b6-dd9f, GHSA-hx75-xjjr-jmv5, MINI-h843-3vh9-2wqp, UBUNTU-CVE-2026-63269.