This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-63276 →
UBUNTU-CVE-2026-63276
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in do...
Original description
The description as published by the source.
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:20.04:LTS
libreoffice
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
libreoffice
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3.7-0ubuntu0.22.04.13"}]}]
Ubuntu:24.04:LTS
libreoffice
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:24.2.7-0ubuntu0.24.04.7"}]}]
Ubuntu:26.04:LTS
libreoffice
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:26.2.6.3-0ubuntu0.26.04.2"}]}]
References
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report libreoffice.org
- report libreoffice.org