Information disclosure in LibreOffice - CVE-2026-63278
Published: October 19, 2026
Vulnerability identifier: #VU156136
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63278
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can use package URLs to exfiltrate arbitrary INI file values and environment variables.
Affected software
LibreOffice
Debian Linux
libreoffice (Debian package)
Debian Linux
libreoffice (Debian package)
How to mitigate CVE-2026-63278
Install updates from vendor's website.
LibreOffice - update to 26.2.5
libreoffice (Debian package) - update to 4:25.2.3-2+deb13u7
libreoffice (Debian package) - update to 4:25.2.3-2+deb13u7