---
id: CVE-2026-63272
title: 'LibreOffice can import WMF graphics, which may be embedded in documents'
summary: >-
  LibreOffice can import WMF graphics, which may be embedded in documents. A
  heap buffer overflow existed when importing a text record that carries its own
  character advance widths. The count of advance values and the length of the
  text we…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P'
cwe:
  - CWE-125
  - CWE-787
vendor: The Document Foundation
product: LibreOffice
affected:
  - LibreOffice >= 26.2 < < 26.2.5
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:09:32.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63272'
references:
  - url: 'https://www.libreoffice.org/about-us/security/advisories/cve-2026-63272'
    label: security@documentfoundation.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T12:28:06.314218Z'
cvssSource: cna
ingestedAt: '2026-09-22T12:03:01.597Z'
epss: 0.00167
epssPercentile: 0.05279
---

## Overview

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two. In fixed versions an advance array shorter than its text is ignored.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.