{"id":"CVE-2026-63273","title":"LibreOffice Draw can import PDF documents","summary":"LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size ke…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","cwe":["CWE-787"],"vendor":"The Document Foundation","product":"LibreOffice","affected":["LibreOffice >= 26.2 < < 26.2.5"],"published":"2026-09-22","updated":"2026-09-22","sourceUpdated":"2026-09-22T19:09:32.273","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63273","references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-63273","label":"security@documentfoundation.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-22T12:27:28.185839Z"},"cvssSource":"cna","ingestedAt":"2026-09-22T12:03:01.595Z","slug":"CVE-2026-63273","body":"## Overview\n\nLibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}