LibreOffice CVE-2026-63278

Exploitation requires a victim to open an attacker-supplied document in LibreOffice that contains links whose URLs name the package content provider in a way the CVE-2024-12426 check did not match, triggering expansion of environment-variable or INI-file values into the URL. Limiting factors: local attack vector (AV:L) - the malicious document must be delivered to and opened by the victim (UI:P/UI:R); impact is confined to disclosure of local environment/INI data (no integrity or availability impact); and the flaw only affects unpatched versions since fixed builds match the package content provider when the URL is checked. No special non-default configuration is required - the expansion occurs against normal document handling.

This is a moderate-severity information-disclosure flaw and an INCOMPLETE-FIX of CVE-2024-12426 - the earlier check failed to recognize every naming of the package content provider, so a differently-named URL still reached environment-variable/INI expansion. Signal alignment is consistent and points to bounded, not urgent, risk: the vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H) scores 6.7, driven by high confidentiality on the vulnerable and subsequent systems but requiring local vector and passive user interaction (opening a document). No EPSS score, no CISA KEV listing, and no public exploit code were provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The realistic risk is targeted social-engineering (delivering a booby-trapped document) rather than mass automatable exploitation: impact is limited to confidentiality (env vars / INI values exfiltrated), with no integrity or availability impact. Note a modeling tension: the vendor uses PR:L, but a document-opening attack is typically driven by the victim's own privileges with the real gate being user interaction (opening the file) rather than attacker-held privilege - I model this as PR:N/UI:R instead. Treat as a standard-priority patch, not an emergency.

An attacker crafts an office document containing hyperlinks whose URLs name the package content provider in a form the CVE-2024-12426 check does not recognize, causing environment-variable or INI-file values to be expanded into the URL. When a victim opens the document (passive interaction), the constructed link silently exfiltrates that potentially sensitive local information to an attacker-controlled remote server. No public exploit code was provided in the intelligence at time of analysis.