CVE-2026-63275 — Stack buffer overflow in CFF font hint handling
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against th…
Published: 2026-09-22 · CVSS: 5.4 · CVSS 4.0
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7