CVE-2026-63272 Heap buffer overflow in WMF text record import
Heap buffer overflow in LibreOffice WMF import allows attackers to execute arbitrary code or cause denial of service via crafted documents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-63272?
CVE-2026-63272 is a medium-severity memory corruption vulnerability in The Document Foundation LibreOffice, published on 22 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.
Which versions are affected by CVE-2026-63272?
How do I fix CVE-2026-63272?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-63272 being exploited?
There is no known exploitation of CVE-2026-63272 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-63272, ECHO-94b9-8ec3-458f, GHSA-c374-v965-jr6c, MINI-7q8m-38rj-5g56, UBUNTU-CVE-2026-63272.