LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a polyline whose point count exceeded the 16-bit range was written past the end of the buffer. In fixed versions such oversized polylines are rejected.
Weakness
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libreoffice | Ubuntu | jammy | * |
| Libreoffice | Ubuntu | noble | * |
| Libreoffice | Ubuntu | questing | * |
| Libreoffice | Ubuntu | resolute | * |
| Libreoffice | Ubuntu | upstream | * |