CVE-2026-63269 PUBLISHED

LFI and GET SSRF via GStreamer and HLS playlists

Assigner: Document Fdn.
Reserved: 16.07.2026 Published: 05.10.2026 Updated: 05.10.2026

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS Score: 6.7

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	Low
User Interaction	Passive

CVSS 4.0

Product Status

Vendor	The Document Foundation
Product	LibreOffice
Versions	Default: unknown affected from 26.2 to < 26.2.5 (excl.)

Credits

Thomas Rinsma and Edoardo Geraci from Codean Labs reporter
Caolán McNamara of Collabora Productivity remediation developer

References

https://www.libreoffice.org/about-us/security/advisories/cve-2026-63269

Problem Types

CWE-918 Server-Side Request Forgery (SSRF) CWE
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE

Impacts

CAPEC-664 Server Side Request Forgery