LibreOffice Draw CVE-2026-63274

Requires the victim to open or import an attacker-crafted PDF document in LibreOffice Draw's PDF-import path (UI:P/UI:R). The trigger is a PDF stream object whose dictionary-declared length exceeds the number of bytes actually present, so the copy overruns the heap buffer. Exploitation is LIMITED to local delivery (AV:L) with mandatory user interaction and no network-facing attack surface; it needs no authentication (PR:N) and no non-default configuration since PDF import is a standard Draw feature. Realistic impact is application crash/DoS (VA:H) rather than reliable code execution, given low confidentiality/integrity metrics.

This is a legitimate but moderate-severity memory-corruption bug, not a top-tier priority. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) makes it a local, user-interaction-gated flaw: an attacker cannot reach it over the network but must convince a victim to open a malicious PDF in LibreOffice Draw. The impact metrics tell the real story - VC:L/VI:L (low confidentiality/integrity) with VA:H (high availability) and Exploit Maturity E:P (proof-of-concept) indicate a crash-dominant heap overflow rather than a reliable code-execution primitive; the score of 5.4 is consistent with that. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation is not confirmed to be occurring or trivially automatable. The signals are internally consistent (local + user-interaction + availability-heavy), so there is no CVSS-vs-description contradiction to flag. Bottom line: a real, patch-worthy heap CWE-787 write, but a targeted-social-engineering issue rather than a mass-exploitation emergency.

An attacker crafts a PDF whose embedded stream object declares a length larger than the bytes actually present, then delivers it via email or download to a target. When the victim imports/opens the PDF in LibreOffice Draw, the copy routine reads and writes past the end of the heap buffer, corrupting heap memory and typically crashing the application; reliable code execution would require additional heap-grooming work. No public exploit is identified at time of analysis (Exploit Maturity is only proof-of-concept).