Executive brief
LibreOffice can export documents to PDF and may embed CFF fonts in them. When converting these fonts to Type 1 format during subsetting, a buffer overflow vulnerability allows a malicious document to write data past a fixed-size buffer. An attacker with a crafted document could crash the application or potentially execute arbitrary code.
Technical details
A stack buffer overflow exists in LibreOffice's CFF to Type 1 font conversion routine, which occurs during PDF export when fonts are subsetted. Converted font operators are written into a fixed-size buffer without bounds checking; a glyph emitting many operators will overflow the stack buffer. The attack vector is opening a malicious document with embedded CFF fonts and exporting to PDF.
Affected products
- LibreOffice LibreOffice before 26.2.5
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fixed in LibreOffice 26.2.5