CVE-2026-63275

Name	CVE-2026-63275
Description	LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libreoffice (PTS)	bookworm	4:7.4.7-1+deb12u14	vulnerable
	bookworm (security)	4:7.4.7-1+deb12u13	vulnerable
	trixie	4:25.2.3-2+deb13u6	vulnerable
	trixie (security)	4:25.2.3-2+deb13u5	vulnerable
	forky, sid	4:26.8.0.3-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libreoffice	source	(unstable)	4:26.2.5.2-1

https://www.libreoffice.org/security/#cve-2026-63275