LibreOffice CVE-2026-63276

Exploitation requires the victim to open an attacker-supplied document containing a maliciously embedded CFF font AND to trigger font subsetting - specifically by exporting the document to PDF (or any code path that subsets the embedded font). It is not remotely reachable without this action: the CVSS vector is AV:L with UI:P (user interaction/passive victim participation required) and no privileges (PR:N). Limiting factors: the attack is confined to local document processing, the primary outcome is an application crash (VA:H) rather than reliable code execution, and it only manifests when a CFF font is actually embedded and the subset/PDF-export operation runs. Server-side or batch document-to-PDF conversion services that ingest untrusted files are the highest-risk deployment mode.

This is a genuine but moderate-severity memory-corruption bug, not a critical priority. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H) correctly frames it as a locally-vectored, user-interaction-gated flaw whose dominant impact is availability (VA:H, i.e. a crash) with only limited confidentiality/integrity impact from the out-of-bounds stack write. The E:P threat metric in the supplied vector indicates proof-of-concept-level exploit maturity, but the input provides no explicit standalone POC reference, no EPSS score, and no CISA KEV entry - so exploitation status is best characterized as 'no public exploit identified' with a caveat that the vendor's own E:P suggests PoC awareness. No SSVC decision data was supplied. The signals are internally consistent: a stack buffer overflow (CWE-787) in a font-conversion routine that only runs when a victim opens a malicious document and drives PDF export is realistically a crash/DoS with speculative code-execution potential, not a mass-exploitable remote vulnerability. Treat as a normal patch-cycle item, prioritized higher for environments doing automated/server-side document-to-PDF conversion where attacker-supplied files are processed at scale.

An attacker crafts an office document embedding a malicious CFF font whose glyph program emits far more Type 1 operators than the fixed conversion buffer can hold, then delivers it to a victim (email attachment, download, or an automated PDF-conversion pipeline). When the victim opens the document and exports it to PDF, LibreOffice subsets and converts the font, overflowing the stack buffer and crashing the application, with potential for memory corruption. The vendor vector's E:P marker implies proof-of-concept-level maturity, though no standalone public exploit is referenced in the supplied data.