LibreOffice CVE-2026-63275

Exploitation requires the victim to open, in LibreOffice, a document or font resource that embeds a maliciously crafted CFF (Compact Font Format) font whose glyph declares more hints than the destination array's real capacity; the overflow triggers during font reading of the glyph's hints. Limiting factors: mandatory user interaction (UI:P - the victim must open the attacker-supplied file), local execution vector (AV:L), no authentication needed on the victim system, and the confirmed impact is a crash (VA:H) with only limited confidentiality/integrity effect (VC:L/VI:L) - reliable arbitrary code execution is not demonstrated. Affects LibreOffice versions prior to the fix that validates hint count against actual array capacity.

This is a genuine memory-corruption bug (CWE-787 out-of-bounds write) but the exploitation signals point to modest real-world priority rather than an urgent one. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H) is local-vector and requires user interaction (a victim must open a document containing a malicious CFF-embedded font), and the impact profile is crash-dominant (VA:H with only VC:L/VI:L), consistent with a stack overflow that reliably crashes but whose escalation to code execution is unproven and mitigated by modern stack protections. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automatable attack - SSVC would land near 'no exploitation / not automatable / partial technical impact.' The only conflict worth flagging: the CVSS uses AV:L while the flaw is reachable over the network in the sense that malicious documents are commonly delivered via email/web; the vendor's AV:L is defensible because the attack executes locally when the file is opened, but defenders should treat the delivery surface as effectively remote. This is a real-but-not-top-priority patch: broad product footprint keeps it relevant, but the low impact metrics and absence of exploitation signals argue against emergency treatment.

An attacker crafts an office document (or standalone font) embedding a malicious CFF font whose glyph declares more hints than the target array can hold, then delivers it via email or a download. When the victim opens the document in LibreOffice, the font parser writes past the end of a stack buffer while reading the glyph hints, crashing the application (denial of service) with a theoretical, unproven path to code execution. No public exploit code was identified, and exploitation requires the victim to open the attacker's file.