Medium severity · published Oct 5, 2026
CVE-2026-63269
LFI and GET SSRF via GStreamer and HLS playlists
6.7
CVSS
0.1%
EPSS
No
On KEV
Description
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibreOffice · The Document Foundation
26.2 before < 26.2.5 · source: vendor
Affected product
LI
LibreOffice
The Document Foundation
More from LibreOffice
9.8
CVE-2024-5261
TLS certificate are not properly verified when utilizing LibreOfficeKit
8.8
CVE-2023-6186
Link targets allow arbitrary script execution
8.8
CVE-2023-6185
Improper input validation enabling arbitrary Gstreamer pipeline injection
8.5
CVE-2026-63277
RCE via calcext:data-mappings, sql provider and jdbc connector
7.8
CVE-2026-8357
Heap buffer overflow in Calc formula compilation