CVE-2026-63278
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In LibreOffice, URLs could be constructed that expand environment variables or INI file values, potentially exfiltrating sensitive information to a remote server when opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL naming it differently still reached the expansion. In fixed versions, the package content provider is matched when the URL is checked.
Risk Assessment
Opening a malicious document could cause sensitive data (e.g., environment variables) to be sent to an attacker-controlled remote server. This may lead to leakage of sensitive information and a security breach.
Recommendation
Update LibreOffice to a version that includes the fix correctly matching the package content provider. Do not open documents from untrusted sources.
Other vulnerabilities in LibreOffice
See all- CVE-2016-4324High
Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.
- CVE-2016-0795High
LibreOffice versions before 5.0.5 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document.
- CVE-2014-9093High
LibreOffice versions before 4.3.5 allow remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.
- CVE-2014-0247High
LibreOffice version 4.2.4 automatically executes unspecified VBA macros, which may lead to unknown impacts and attack vectors.
- CVE-2017-8358Critical
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.
- CVE-2017-7882Critical
LibreOffice before March 14, 2017, has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
- CVE-2017-7870Critical
LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.
- CVE-2017-7856Critical
LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function.
- CVE-2016-10327Critical
LibreOffice before December 22, 2016, has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx.
- CVE-2026-63279Medium
LibreOffice can import PICT images, which may be embedded in documents. An out-of-bounds read occurs when importing an image that uses a colour palette because the palette index is not checked against the number of entries. In fixed versions, the palette index is limited to the entries present.
Original NVD description (English source)
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS