LibreOffice Releases Patch for PDF Parsing Remote Code Execution Flaw

LibreOffice has released an update to fix a high-severity vulnerability in its PDF parsing engine. This flaw allows remote attackers to execute arbitrary code on affected systems if a user opens a malicious file.

What happened

The Zero Day Initiative published advisory ZDI-26-783 on October 16, 2026, detailing a remote code execution flaw in LibreOffice. The vulnerability, tracked as CVE-2026-63273, stems from how the software parses PDF files. Attackers can craft specific data within a PDF that triggers an out-of-bounds write, allowing them to execute code in the context of the current process.

According to the ZDI, exploitation requires user interaction. The target must either visit a malicious page or open the crafted PDF file. The vendor received the initial report on July 9, 2026, and the coordinated public release occurred on October 16, 2026. The ZDI assigned a CVSS rating of 7.8 to the vulnerability, classifying it as high severity.

Why it matters

An out-of-bounds write error occurs when data is written to a memory location outside its intended buffer. In this case, the flaw exists within the PDF parsing component of LibreOffice. Successful exploitation allows an attacker to run arbitrary code with the privileges of the current process. This capability enables remote code execution on affected installations.

Because the attack vector relies on user interaction, the target must actively engage with the malicious content. The source material does not specify further consequences or attacker motives. The high CVSS score reflects the potential impact of the vulnerability as rated by the Zero Day Initiative.

What to watch

• Monitor vendor channels for additional updates regarding CVE-2026-63273.
• Check internal logs for unusual PDF processing activity or unexpected process spawns.
• Verify that deployed LibreOffice installations have received the security update.
• Review email gateways for blocked attachments containing crafted PDF data.

Who needs to act first

Teams should prioritize updating systems that frequently process external documents, such as mail servers and shared workstations. Verify which LibreOffice versions are deployed before applying the patch to avoid compatibility issues. Test the update in a non-production environment to ensure it does not break existing workflows. Back up critical data before rolling out changes. If immediate patching is not possible, restrict access to untrusted PDF files and educate users on the risks of opening unsolicited attachments.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: LibreOffice

• Apply the latest LibreOffice update to all affected workstations and servers.
• Scan email inboxes and file shares for recently opened or suspicious PDF files.
• Verify that endpoint detection tools are monitoring for unexpected code execution.
• Wait for official vendor guidance before modifying firewall rules or disabling features.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is a patch available for this LibreOffice vulnerability?

Yes, LibreOffice has issued an update to correct the vulnerability associated with CVE-2026-63273.

What is the severity of this flaw?

The Zero Day Initiative assigned a CVSS rating of 7.8 to the out-of-bounds write vulnerability.

How can an attacker exploit this issue?

Exploitation requires user interaction, specifically visiting a malicious page or opening a crafted PDF file.