USN-8868-1: LibreOffice vulnerabilities

LibreOffice has a heap buffer overflow when it imports Windows Metafile (WMF) graphics that can be embedded in documents. A text record can carry its own character advance widths; the count of those widths and the text length are read separately and were not required to match, so drawing the text walks the advance array by character and reads or writes past the end when the array is shorter. A crafted document opened locally can crash LibreOffice (high availability impact) and may cause limited confidentiality or integrity effects inside the process; CVSS 4.0 is 5.4 with local access and user interaction required, and no scope change. Anyone who opens untrusted documents in affected LibreOffice builds is exposed. It is not in CISA KEV, and no public proof-of-concept is known (CVSS exploit maturity E:P does not by itself confirm a public exploit).

Do: Install a LibreOffice build in which a short WMF advance array is ignored, using packages from The Document Foundation or your distribution (Ubuntu: USN-8868-1). Until then, do not open documents from untrusted sources that may embed WMF graphics. The supplied data does not name fixed version numbers, so use the vendor or distro advisory for the exact package.

LibreOffice Draw has a heap buffer overflow (CWE-787) when importing an encrypted PDF. The importer takes the decryption-key length from the document’s own encryption dictionary and uses it to fill a fixed-size key buffer without checking that length, so a declared length larger than the buffer writes past its end. A person must open or import a crafted encrypted PDF (local, user interaction); the overflow can crash Draw and, as scored, has limited confidentiality and integrity impact with high availability impact on the vulnerable component. Anyone using an unfixed LibreOffice that includes Draw is affected; fixed versions reject an oversized declared key length. No public proof of concept is listed and the issue is not in the CISA KEV catalog, although the published CVSS 4.0 vector sets exploit maturity to P and scores the flaw 5.4 (medium).

Do: Update LibreOffice to a fixed release that rejects an encryption-dictionary key length larger than the fixed key buffer; use the Document Foundation advisory and Ubuntu USN-8868-1 for the corrected packages rather than assuming a version number. Until patched, do not import or open untrusted encrypted PDFs in LibreOffice Draw.