CVE-2026-63269 The Document Foundation CVE debrief

Who should care

Linux system administrators, LibreOffice users, and document processing workflow maintainers should assess exposure and prioritize patching. These stakeholders need to verify document handling and link update controls, and review GStreamer configuration and resource access. They should also monitor document loading and media playback, and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

The vulnerability allows linked media files to access local files and remote URLs on Linux systems, potentially leading to unauthorized resource access. Defenders should assess exposure, verify document handling, and prioritize patching.

• Assess exposure of LibreOffice on Linux systems
• Verify document handling and link update controls
• Prioritize patching for document processing workflows

Technical summary

A vulnerability in LibreOffice allows linked media files to access local files and remote URLs on Linux systems, potentially leading to unauthorized resource access. The vulnerability is due to LibreOffice's use of GStreamer to play linked media files on Linux. In fixed versions, LibreOffice does not follow playlists that name further resources, and linked media is under link update control. This change prevents the unauthorized access of local files and remote URLs listed in HLS playlists while a document loads. Defenders should assess exposure, verify document handling, and prioritize patching for document processing workflows.

Defensive priority

Assess exposure of LibreOffice on Linux systems, verify document handling and link update controls, and prioritize patching for document processing workflows.

Recommended defensive actions

• Assess exposure of LibreOffice on Linux systems
• Verify document handling and link update controls
• Prioritize patching for document processing workflows
• Monitor document loading and media playback
• Review GStreamer configuration and resource access

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, and a vendor advisory is available. However, further details on exploitation or impact are not provided. The vulnerability allows linked media files to access local files and remote URLs on Linux systems, potentially leading to unauthorized resource access. Defenders should assess exposure, verify document handling, and prioritize patching. The vendor has provided guidance on fixed versions of LibreOffice.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.