LibreOffice EUVD-2026-92420

Requires a Linux installation of LibreOffice using the GStreamer media backend, a document that links to media where the linked resource is a crafted HLS playlist naming further local files or remote/internal URLs, and a victim who opens the document and permits linked-media/link updates. Exploitation is limited by: Linux-only applicability (not Windows/macOS), the need for user interaction to open the document and allow link updates, and the fact that fixed versions no longer follow playlists that name further resources and keep linked media under link-update control. These factors make exploitation targeted and interaction-dependent rather than automatic.

This is a moderate-severity information-disclosure (SSRF, CWE-918) issue, not an urgent priority. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, 6.7) correctly reflects a local attack vector requiring victim interaction: exploitation depends on a user opening a crafted document on Linux and media links being updated, rather than remote network-triggered compromise. There is no CISA KEV listing and no public exploit identified at time of analysis, so exploitation status is theoretical. No EPSS or SSVC data was supplied in the input, so automatable/exploitation-maturity signals cannot be weighed. The high confidentiality impact (local file and internal-URL disclosure via GStreamer following an HLS playlist) is real and matches a classic SSRF/local-file-read pattern, but the local vector plus required user interaction substantially limit real-world risk. One point to verify with the vendor: the vendor assigned PR:L, yet a malicious-document attack typically needs no attacker privileges on the target system (PR:N) - this metric choice should be confirmed. Overall: patch in normal cycles, not an emergency.

An attacker emails or shares a LibreOffice document that contains what appears to be a linked audio/video file but is actually an HLS playlist. When a Linux victim opens the document and linked media is updated, GStreamer follows the playlist entries, reading local files and attacker-specified remote/internal URLs, and their contents are pulled into the document where the attacker can later retrieve them. No public exploit is identified at time of analysis, and the local vector plus required user interaction make this an opportunistic social-engineering attack rather than a mass-exploitable one.