Описание
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.
A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash.
Отчет
To exploit this issue, an attacker needs to convince a user to open a specially crafted document. This flaw can cause memory corruption, resulting in an application crash. However, the possibility of arbitrary code execution is not discarded. For these reasons, this vulnerability has been rated with a moderate severity. Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.
Меры по смягчению последствий
Do not open documents from unknown or untrusted sources with LibreOffice.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libreoffice | Out of support scope | ||
| Red Hat Enterprise Linux 7 | libreoffice | Affected | ||
| Red Hat Enterprise Linux 8 | flute | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libbase | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libfonts | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libformula | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | liblayout | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libloader | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libreoffice | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | librepository | Fixed | RHSA-2026:88164 | 22.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.
LibreOffice can read CFF fonts, which may be embedded in documents. A ...
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint count is checked against the capacity the array really has.
Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update
EPSS
7.3 High
CVSS3