CVE-2026-63273: LibreOffice PDF Parsing Out-of-Bounds Write — Detection, Hunting, and Remediation Guide

---
title: LibreOffice Process Spawning Suspicious Child Process
id: 8f2c1a94-6e3b-4d7a-b2c9-4a1f8e5d7c31
status: experimental
description: Detects soffice.bin spawning command shells, script interpreters, or LOLBins — a strong indicator of successful document exploit execution such as CVE-2026-63273 (LibreOffice PDF parsing OOB write, ZDI-26-783).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-783/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\soffice.bin'
      - '\soffice.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare LibreOffice macro or extension behavior invoking system commands — investigate parent command line and user context
level: high
---
title: LibreOffice Writing Executable Content to Suspicious Locations
id: 3d7e9b21-5a4c-4f8e-91d6-2c8b7a4e9f12
status: experimental
description: Detects LibreOffice processes writing executable or script files to user-writable or temporary directories, consistent with payload staging after exploitation of a document parsing flaw such as CVE-2026-63273.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-783/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\soffice.bin'
      - '\soffice.exe'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Downloads\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.vbs'
      - '.js'
      - '.hta'
      - '.scr'
  condition: selection_image and selection_path and selection_ext
falsepositives:
  - LibreOffice extension installers and update mechanisms — correlate with known update windows
level: high
---
title: LibreOffice Crash Indicating Memory Corruption Attempt
id: 6b1a4f78-2d9e-4c5b-a8f3-7e2d1c9b6a45
status: experimental
description: Detects application error or Windows Error Reporting events for soffice.bin referencing memory-corruption-related fault modules or exception codes (e.g., 0xc0000005 access violation), which may indicate failed exploitation attempts against the PDF parser (CVE-2026-63273).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-783/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\wermgr.exe'
    CommandLine|contains: 'soffice'
falsepositives:
  - Genuine application instability from malformed-but-benign documents — cluster events by user/host and investigate repeated crashes
level: medium

// Hunt: LibreOffice spawning suspicious child processes or dropping payloads (CVE-2026-63273 / ZDI-26-783)
let lookback = 14d;
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","wmic.exe","curl.exe"]);
let suspiciousExt = dynamic([".exe",".dll",".ps1",".bat",".vbs",".js",".hta",".scr",".sh"]);
let procEvents = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ ("soffice.bin","soffice.exe","soffice","oosplash")
| where FileName in~ (suspiciousChildren)
    or ProcessCommandLine has_any ("bash -c","/bin/sh","curl ","wget ","base64")
| project TimeGenerated, DeviceName, AccountName,
    Parent=InitiatingProcessFileName, ParentCmd=InitiatingProcessCommandLine,
    Child=FileName, ChildCmd=ProcessCommandLine, SHA256, FolderPath;
let fileEvents = DeviceFileEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ ("soffice.bin","soffice.exe","soffice","oosplash")
| where FileName has_any (suspiciousExt)
| where FolderPath has_any ("\\Temp\\","\\AppData\\","\\Public\\","\\ProgramData\\","\\Downloads\\","/tmp/","/dev/shm/","/home/")
| project TimeGenerated, DeviceName, AccountName,
    Writer=InitiatingProcessFileName, DroppedFile=FileName, FolderPath, SHA256, ActionType;
procEvents
| union fileEvents
| order by TimeGenerated desc

// Hunt: Repeated soffice crashes (possible failed exploit attempts) via WER / Defender health events
let lookback = 14d;
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName =~ "wermgr.exe"
| where ProcessCommandLine has "soffice"
| summarize CrashCount=count(), FirstCrash=min(TimeGenerated), LastCrash=max(TimeGenerated)
    by DeviceName, AccountName
| where CrashCount >= 2
| order by CrashCount desc

-- Hunt: LibreOffice processes with suspicious command lines, children, or network connections
-- Targets post-exploitation behavior of document parsing RCE (CVE-2026-63273 / ZDI-26-783)

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)soffice|oosplash'
   OR (
        CommandLine =~ '(?i)(cmd\.exe|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|/bin/sh|bash -c|curl |wget )'
        AND Ppid IN (
            SELECT Pid FROM pslist() WHERE Name =~ '(?i)soffice|oosplash'
        )
      )

-- Hunt: Network connections from LibreOffice processes (LibreOffice should rarely initiate outbound connections outside update/telemetry)
SELECT Pid, Name, Path, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ '(?i)soffice'
  AND Raddr.IP !~ '^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|0\.0\.0\.0|$)'
ORDER BY RemoteIP

# CVE-2026-63273 / ZDI-26-783 — LibreOffice inventory, version check, and exposure reduction
# Reference: http://www.zerodayinitiative.com/advisories/ZDI-26-783/

$report = @()

# 1. Enumerate installed LibreOffice versions (x64 and x86 registry hives)
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
foreach ($path in $uninstallPaths) {
    Get-ItemProperty $path -ErrorAction SilentlyContinue |
        Where-Object { $_.DisplayName -match 'LibreOffice' } |
        ForEach-Object {
            $report += [PSCustomObject]@{
                Computer    = $env:COMPUTERNAME
                Product     = $_.DisplayName
                Version     = $_.DisplayVersion
                InstallPath = $_.InstallLocation
                Action      = 'REVIEW — compare against vendor fixed release and update immediately'
            }
        }
}

# 2. Check for soffice binaries outside standard install paths (shadow/unmanaged installs)
$orphans = Get-ChildItem -Path 'C:\Program Files','C:\Program Files (x86)','C:\Users' -Recurse -Filter 'soffice.bin' -ErrorAction SilentlyContinue |
    Where-Object { $_.FullName -notmatch 'LibreOffice' }
foreach ($o in $orphans) {
    $report += [PSCustomObject]@{
        Computer    = $env:COMPUTERNAME
        Product     = 'Unmanaged soffice.bin'
        Version     = ($o.VersionInfo.ProductVersion)
        InstallPath = $o.FullName
        Action      = 'INVESTIGATE — unmanaged installation'
    }
}

# 3. Hardening: block soffice from spawning child processes via WDAC/ASR-style audit (Defender ASR rule: block Office child processes covers Office; for LibreOffice use a custom AppLocker/WDAC deny or monitor-only)
# At minimum, enable process creation auditing with command line logging for detection fidelity:
$audit = auditpol /get /subcategory:"Process Creation" 2>$null
if ($audit -notmatch 'Success') {
    auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable | Out-Null
}
# Enable command line capture in process creation events
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1 -ErrorAction SilentlyContinue

# 4. Export findings
$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:ProgramData\LibreOffice_CVE-2026-63273_Inventory.csv" -NoTypeInformation -Force
Write-Output "Inventory written to $env:ProgramData\LibreOffice_CVE-2026-63273_Inventory.csv"

#!/bin/bash
# CVE-2026-63273 — LibreOffice inventory and patch status check (Debian/Ubuntu & RHEL/Fedora)

echo "=== Installed LibreOffice packages ==="
if command -v dpkg >/dev/null 2>&1; then
    dpkg -l | grep -i libreoffice
elif command -v rpm >/dev/null 2>&1; then
    rpm -qa | grep -i libreoffice
fi

echo "=== Checking for headless conversion services (server-side parsing risk) ==="
ps aux | grep -i 'soffice.*headless' | grep -v grep
ss -tlnp 2>/dev/null | grep -i soffice

echo "=== Applying vendor updates ==="
if command -v apt-get >/dev/null 2>&1; then
    apt-get update && apt-get install --only-upgrade -y libreoffice-core libreoffice-common
elif command -v dnf >/dev/null 2>&1; then
    dnf update -y libreoffice*
fi

echo "=== Verifying no soffice processes remain post-patch ==="
pkill -f soffice 2>/dev/null; echo "Done. Re-run version check to confirm fixed build."