Executive brief
LibreOffice Draw, which allows users to open and edit PDF documents, contains a heap buffer overflow vulnerability when processing PDF streams. An attacker who crafts a malicious PDF with an incorrect stream length declaration could cause a buffer overflow, potentially leading to code execution when the document is imported. The vulnerability is fixed in LibreOffice 26.2.5.
Technical details
A heap buffer overflow exists in PDF stream object import when the declared stream length in the PDF dictionary is not validated against the actual bytes present. The stream copying operation uses the untrusted length value without bounds checking, causing a write past the buffer end. The fix clamps the declared length to the number of bytes actually read from the file.
Affected products
- LibreOffice Draw before 26.2.5
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fixed in LibreOffice 26.2.5