Critical Security Flaw in LibreOffice: Heap and Stack Buffer Overflows
Summary
ALSA-2026:82013: Important: libreoffice security update. Affects autocorr-af versions < 1:7.1.8.1-15.el9_8.3.alma.1. Fixed in 1:7.1.8.1-15.el9_8.3.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
LibreOffice is an open-source office productivity suite that includes applications for word processing, spreadsheets, presentations, and more. It is widely used as a free alternative to Microsoft Office. The suite is developed by a community of contributors and is known for its extensive features and compatibility with various document formats. However, recent vulnerabilities have been identified that could compromise the security of users' data and systems.
Vulnerability Detail
The vulnerabilities in LibreOffice stem from heap and stack buffer overflows during the handling of PDF import streams and font conversions. Specifically, CVE-2026-63274 involves a heap buffer overflow, while CVE-2026-63275 and CVE-2026-63276 relate to stack buffer overflows in font hint handling and CFF to Type 1 font conversion, respectively. Additionally, CVE-2026-63277 allows for arbitrary code execution via a remote Java database driver. These vulnerabilities could lead to unauthorized access, data corruption, or execution of malicious code.
How To Fix
Minimum fixed version
1:7.1.8.1-15.el9_8.3.alma.1
This is the first release that contains the fix.
sudo dnf update autocorr-afTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the use of Java database drivers in LibreOffice until the update is applied. This can be done by navigating to Tools > Options > LibreOffice > Advanced and unchecking the 'Use a Java runtime environment' option.
Conclusion
The vulnerabilities identified in LibreOffice pose significant risks to users, including potential data breaches and unauthorized code execution. It is crucial for users to update to the latest patched version to ensure their systems remain secure. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for autocorr-af →
FAQ
The main vulnerabilities include heap and stack buffer overflows and arbitrary code execution via a remote Java database driver.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without signing up.
As a temporary measure, disable the use of Java database drivers in LibreOffice to mitigate the risk until you can apply the update.
It is recommended to check for updates regularly, at least once a month, or whenever a security advisory is released.
For detailed information, refer to the CVE pages linked in the security advisory or the official LibreOffice documentation.
Related vulnerabilities
Recent vulnerabilities recorded for autocorr-af.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
