LibreOffice CVE-2025-14714

Exploitation requires: (1) local access with the ability to execute binaries on a macOS host (AV:L); (2) an affected build - LibreOffice on macOS 25.2 before 25.2.4 (Linux/Windows unaffected); and (3) the critical attack requirement (AT:P) that the user has previously granted TCC permissions (e.g. Full Disk Access, Documents, camera, contacts) to the LibreOffice application bundle - if no TCC grants exist, there are no inherited privileges to abuse. The attacker gains only whatever TCC scope the user already approved for LibreOffice, nothing more. Limiting factors: no remote vector, attacker must already have local code-execution capability, and the payoff is bounded entirely by the user's existing TCC grants to the app.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 score is 0.9 (Low), driven by AV:L (local attack vector - the attacker must already be able to run code on the Mac), AT:P (a specific attack requirement: the user must have previously granted TCC permissions to the LibreOffice bundle), and PR:L (low privileges required). The only impact is SC:H - confidentiality of subsequent/other systems/resources protected by macOS TCC (e.g. files, contacts, camera) - with no integrity or availability impact (VI:N/VA:N) and no direct impact on the vulnerable component itself (VC:N). EPSS reinforces low real-world risk at 0.14% (3rd percentile). There is NO CISA KEV listing and NO public exploit - the CVSS exploit-maturity metric is explicitly E:U (unreported). All signals agree: this is a local privilege/permission-boundary weakness that is only meaningful to an attacker who already has local code execution on a Mac where the user granted TCC permissions to LibreOffice. It is correctly a low-CVSS, low-real-risk issue, not an urgent priority. Note the CWE-288 (authentication bypass) framing is slightly generous - functionally this is a TCC permission-inheritance / confused-deputy problem rather than a classic auth bypass.

An attacker with local, low-privilege access to a macOS host running an affected LibreOffice version directly invokes the Python interpreter bundled inside the LibreOffice.app bundle. Because that interpreter inherits the TCC permissions the user granted to LibreOffice, the attacker's scripts gain access to TCC-protected resources (such as files, contacts, or camera) that their own process would otherwise be denied. No public exploit identified at time of analysis.