USN-8868-1: Eight CVEs in LibreOffice, Patches for Ubuntu 22.04, 24.04 and 26.04 LTS
Ubuntu has published USN-8868-1: eight vulnerabilities in LibreOffice, some carrying a risk of arbitrary code execution. An update is available for 22.04, 24.04 and 26.04 LTS.
UptimeMag editorial team · 5 October 2026 · 1 min read
On 5 October 2026, Ubuntu published security advisory USN-8868-1, which fixes eight vulnerabilities in LibreOffice. This affects anyone running Linux workstations or servers with the office suite installed for automated document conversion: some of the flaws allow arbitrary code execution via malicious files.
The issues fixed
According to the official Ubuntu advisory, the flaws relate to the handling of several import formats:
- import of malformed WMF images: crash or code execution (CVE-2026-63272)
- import of PDF documents: crash or code execution (CVE-2026-63273, CVE-2026-63274)
- CFF fonts embedded in documents: crash or code execution (CVE-2026-63275, CVE-2026-63276)
- incorrect validation of package URLs: possible exposure of sensitive information (CVE-2026-63278)
- import of PICT images: crash or information exposure (CVE-2026-63279)
- out-of-bounds writes via Graphite font actions, incompletely mitigated: crash or code execution (CVE-2026-50593)
The advisory text does not go into further detail on attack vectors beyond what is reported above.
Packages and fixed versions
| Ubuntu Release | Codename | Fixed libreoffice version |
|---|---|---|
| 26.04 LTS | resolute | 4:26.2.6.3-0ubuntu0.26.04.2 |
| 24.04 LTS | noble | 4:24.2.7-0ubuntu0.24.04.7 |
| 22.04 LTS | jammy | 1:7.3.7-0ubuntu0.22.04.13 |
The update arrives as a new upstream release, which also includes non-security bug fixes. According to Ubuntu, a standard system update (apt update && apt upgrade) applies all the necessary changes.
What to do
On Ubuntu 22.04, 24.04 or 26.04 machines with LibreOffice installed, check the package version with apt-cache policy libreoffice and, if it's lower than the version indicated, run the update. A system reboot is not required, but any LibreOffice instances already open need to be closed and reopened to load the updated binaries.
Ubuntu also notes, in the same advisory, that Ubuntu Pro provides ten years of security coverage on more than 25,000 packages from the Main and Universe repositories, free of charge for up to five machines.
Source: official Ubuntu Security Notices advisory, USN-8868-1, https://ubuntu.com/security/notices/USN-8868-1
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50). Source: Ubuntu – avvisi di sicurezza.