LibreOffice Draw CVE-2026-63273

Exploitation requires the victim to open a specially crafted ENCRYPTED PDF document in LibreOffice Draw's PDF import path; the trigger is a decryption-key length value in the document's encryption dictionary set larger than the fixed key buffer. Limiting factors: the vector is local (the malicious file must be delivered to and opened by the victim, AV:L + UI:P), so there is no remote or unauthenticated network trigger; the file must specifically be encrypted (unencrypted PDFs do not reach this code path); and fixed LibreOffice versions reject an over-large declared key length, closing the flaw.

This is a moderate-priority memory-corruption bug, not an urgent one. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H, score 5.4) makes clear that despite a heap out-of-bounds write (CWE-787), exploitation requires a local vector (AV:L) plus victim interaction (UI:P) - the user must open a malicious encrypted PDF in LibreOffice Draw. The high availability impact (VA:H) with only low confidentiality/integrity impact (VC:L/VI:L) signals this is crash-dominant, with code execution plausible but not demonstrated. Exploit maturity is E:P (proof-of-concept), which conflicts with the reference set: only the LibreOffice advisory is provided, and there is NO EPSS score, NO CISA KEV listing, and NO standalone public exploit code - so the E:P maturity is not independently corroborated by any of the supplied intelligence. No public exploit identified at time of analysis. The overwrite length is fully attacker-controlled (a declared key length in the document's own encryption dictionary), which raises exploitability in principle, but the local+user-interaction gating keeps real-world risk bounded to targeted social-engineering rather than mass exploitation. Net: a legitimate patch-worthy flaw, but not a drop-everything priority absent evidence of exploitation.

An attacker crafts a malicious encrypted PDF whose encryption dictionary declares a decryption-key length far larger than LibreOffice's fixed-size key buffer, then delivers it to a victim (email attachment, download). When the victim opens the file in LibreOffice Draw, the import code copies the oversized key past the buffer end, corrupting the heap and crashing the application or potentially enabling code execution. No public exploit code is identified; the vendor rates exploit maturity as proof-of-concept only.