CVE-2026-63269

EUVD-2026-92420
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
libreoffice
bookworm
vulnerable
bookworm (security)
vulnerable
forky
4:26.8.0.3-2
fixed
sid
4:26.8.1.1-3
fixed
trixie
vulnerable
trixie (security)
4:25.2.3-2+deb13u8
fixed