Executive brief
LibreOffice, a document editing and creation suite, can embed PICT images in documents. When opening a specially crafted document with a malicious PICT image using a colour palette, an unchecked palette index causes the software to read memory outside the intended buffer, potentially exposing sensitive data from the process.
Technical details
An out-of-bounds read vulnerability exists in PICT image import when a palette index is used without validation against the actual number of palette entries. An attacker can craft a PICT image embedded in a document where the palette index references memory beyond the palette array bounds, leaking adjacent memory contents. The fix validates the palette index against the palette size before use.
Affected products
- LibreOffice LibreOffice before 26.2.5
Timeline
- 2026-09-21: disclosed
- 2026-09-22: patched: LibreOffice 26.2.5