Back to Security Advisories
Flute, Libbase, Libfonts, Libformula, Liblayout, Libloader, Libreoffice, Librepository, Libserializer, Pentaho-Libxml, Pentaho-Reporting-Flow-Engine, And Sac Security Update — AlmaLinux 8 (ALSA-2026:88164)
ALSA-2026:88164 updates the LibreOffice and Pentaho reporting library packages on AlmaLinux 8, fixing four flaws led by a heap buffer overflow in LibreOffice's PDF import stream handling (CVE-2026-63274) and stack buffer overflows in CFF-to-Type-1 font conversion (CVE-2026-63276) and CFF font hint handling (CVE-2026-63275), plus an arbitrary-code-execution flaw (CVE-2026-63277). Update the package set with dnf update on servers that process documents headlessly.
High
5.4 CVSS
AlmaLinux 8
What this means under a SharedLicense license
Document-parsing flaws are triggered by opening a crafted file: on servers running headless LibreOffice conversions (the common automation pattern), a malicious uploaded document becomes remote code execution in the conversion worker.
SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fix(es): * libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274) * libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276) * libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275) * libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277) Bug Fix(es) and Enhancement(s): * [libbase] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275415) * [flute] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275416) * [libserializer] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275417) * [libloader] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275418) * [libformula] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275419) * [librepository] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275420) * [libfonts] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275421) * [liblayout] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275422) * [pentaho-libxml] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275423) * [pentaho-reporting-flow-engine] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275424) * [sac] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-277813) * [libreoffice] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-260518) * [AlmaLinux 8.10] Base Report Wizard fails with packaged Pentaho reporting engine (JIRA:AlmaLinux-286491) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Frequently Asked Questions
What does ALSA-2026:88164 fix?
Four LibreOffice-related vulnerabilities across the Flute, Libbase, Libfonts, Libformula, Liblayout, Libloader, Libreoffice, Librepository, Libserializer, Pentaho-libxml and Pentaho-reporting-flow-engine packages: a heap buffer overflow in PDF import stream handling (CVE-2026-63274), stack buffer overflows in CFF to Type-1 font conversion (CVE-2026-63276) and CFF font hint handling (CVE-2026-63275), and an arbitrary code execution flaw (CVE-2026-63277). Aggregate CVSS 5.4, out-of-bounds read class (CWE-125) also present.
Who is affected?
AlmaLinux 8 servers with LibreOffice or the Pentaho reporting libraries installed — most commonly headless document-conversion workers. Desktop conversion of untrusted files is the same risk.
How do I apply the fix?
Run dnf update 'libreoffice*' along with the other listed packages (or a general dnf update) and restart any long-running conversion services so they load the patched libraries.
Why does a font-conversion bug matter for servers?
CFF font and PDF import code parses attacker-controlled data inside documents — crafted fonts or embedded PDFs are the delivery channel, and memory-corruption flaws there are a classic document-to-RCE path on automation workers.
References
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System