Libreoffice
Monthly
Remote code execution in LibreOffice Calc allows attackers to execute arbitrary Java code by embedding a crafted external data link that loads a malicious Java database driver from a remote URL when the document is opened. This affects LibreOffice versions prior to the fix that enforces file URLs for Java class-path entries. Exploitation requires user interaction (opening the document) and a local attack vector; no public exploit has been identified at time of analysis, yet the high-severity impact can fully compromise the user's system.
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Environment-variable and INI-file value disclosure in LibreOffice lets a crafted document exfiltrate host configuration data to a remote server when the victim opens it, because document-supplied URLs can still be expanded in code paths that the earlier CVE-2024-12426 fix missed. The incomplete fix overlooked XForms instance data and the Calc CSV and SQL data providers, which continue to resolve internal-scheme URLs originating from the document. This is a moderate-severity, confidentiality-only flaw (CVSS 4.0 base 6.7, CWE-200) that requires the victim to open an attacker-supplied file, with no public exploit identified at time of analysis; the independent assessment scores it as a local-vector, passive-user-interaction issue with no impact on integrity or availability.
Server-side request forgery in LibreOffice on Linux can expose local files and internal or remote URLs when a document links to a crafted HLS media playlist and the victim opens it and permits link updates. LibreOffice relies on the GStreamer media backend on Linux to play linked audio and video; a malicious playlist's listed resources were fetched while the document loaded and their contents could be written into the document, yielding confidentiality impact (VC:H, SC:H) with no integrity or availability impact in the assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N). The issue is moderate severity and interaction-dependent rather than an urgent priority; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and exploitation is constrained to Linux installations using the GStreamer backend.
Opening a crafted LibreOffice Calc document can cause a local text file on the victim's machine to be read into the spreadsheet, leaking its contents to anyone who later views or receives the file. The document must embed a saved external data link of the sql type that points at a local folder of text files as a database; vulnerable versions automatically restore that link at load time, whereas fixed versions restore only the csv, html and xml data providers. Exploitation requires the victim to open the attacker-supplied document (user interaction, UI:P in the vendor's CVSS 4.0 vector of 6.7, and UI:R in the independent CVSS 3.1 assessment), so exposure is limited to targeted social-engineering scenarios where the attacker also knows or guesses a useful local path and has a way to retrieve the populated sheet; no public exploit identified at time of analysis and the issue is not in CISA KEV.
LibreOffice Calc on affected versions automatically fetched external CSV data links embedded in a spreadsheet while the document loaded, so an attacker-crafted Calc file could read a local file into a sheet or force a request to a host of the document author's choosing (SSRF, CWE-918). Exploitation is local and interaction-gated - the attacker must deliver the malicious document and the victim must open it - and the flaw affects confidentiality only, with no impact on integrity or availability. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor addressed it by placing external data links under the same link-update control that governs other spreadsheet links.
LibreOffice Calc fails to confine file operations when processing an external data-source link to an embedded Firebird database, allowing a crafted document to write files to any location the user has write permission to. Exploitation requires the victim to open the malicious spreadsheet (user interaction) and does not by itself escalate privileges; no public exploit or active exploitation has been identified at time of analysis. The vulnerability is a moderate-severity, user-interaction-dependent file-write issue (CVSS 6.8) rather than a high-priority remote threat.
An out-of-bounds read in LibreOffice's PICT image import path allows a crafted PICT image - one whose stored palette index exceeds the number of entries in its colour palette - to read memory past the end of the palette buffer, crashing the application and potentially disclosing a small amount of adjacent heap memory. Exploitation requires a victim to locally open a document or image that embeds the malicious PICT file; no authentication or non-default configuration is required because PICT import is a standard feature, and the assessed CVSS vector carries an Exploit Maturity of Proof-of-Concept (E:P), indicating proof-of-concept exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this as a moderate-severity, denial-of-service-oriented client-side memory-safety bug (CVSS 3.1 base 5.4-equivalent, AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) rather than a high-priority remotely exploitable flaw.
Information disclosure in LibreOffice allows a crafted document containing hyperlinks to cause local environment-variable and INI-file values to be expanded into the URL and exfiltrated to a remote server when the victim opens the file. The flaw is an incomplete fix for CVE-2024-12426: the earlier guard matched only some ways of naming the package content provider, so a URL naming it differently still reached the expansion logic, whereas fixed builds match the provider during URL checking. Exploitation requires the victim to open an attacker-supplied document (UI:R / UI:P) on the local attack vector, there is no public exploit identified at time of analysis, and the primary impact is confidentiality only (no integrity or availability loss).
Stack buffer overflow in LibreOffice's font subsetting path can crash the application and corrupt memory when a document containing an embedded CFF font is exported to PDF. The vulnerable routine converts CFF (Compact Font Format) glyphs to Type 1 operators during subsetting and writes them into a fixed-size stack buffer without verifying remaining capacity, so a glyph that emits many operators overflows the buffer (CWE-787). Exploitation is local and requires the victim to open an attacker-supplied document and trigger the subsetting code path (typically a PDF export); the CVSS v4.0 base score is 5.4 with PR:N and UI:P, and despite a proof-of-concept maturity rating (E:P) indicating publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV). The most likely outcome is an application crash (VA:H) with limited confidentiality and integrity impact; headless or server-side document-to-PDF conversion services that ingest untrusted files are the highest-risk deployment mode.
Stack-based out-of-bounds write in LibreOffice's CFF font hint parser allows an attacker to corrupt memory and crash the application when a victim opens a document that embeds a maliciously crafted font. Affected are LibreOffice versions before the fix that checks the hint count against the array's actual capacity; exploitation requires the victim to open the crafted file (local vector, user interaction) and no authentication, with confirmed impact limited to a crash plus limited confidentiality/integrity effects-reliable arbitrary code execution is not demonstrated. No CISA KEV listing indicates active exploitation, but the CVSS 4.0 exploit maturity metric E:P indicates publicly available exploit code exists, so patching should be prioritized for users who handle untrusted documents.
Heap buffer overflow in LibreOffice Draw's PDF import path allows a crafted PDF to corrupt heap memory and crash the application when a victim opens or imports the document; the independent assessment rates confidentiality and integrity impact as low but availability impact as high, making denial of service the most realistic outcome. Exploitation requires local delivery and mandatory user interaction, and no authentication or non-default configuration is needed because PDF import is a standard feature. Publicly available exploit code exists per the CVSS 4.0 E:P metric, but there is no confirmed active exploitation (no CISA KEV entry); no EPSS score was provided.
Heap-based buffer overflow in LibreOffice's PDF import filter, reachable through LibreOffice Draw, can crash the application or corrupt heap memory when a victim opens a specially crafted encrypted PDF whose encryption dictionary declares a decryption-key length larger than the fixed-size key buffer the importer fills. Exploitation is local and requires user interaction (AV:L, UI:P/UI:R, PR:N per the CVSS 4.0 vector; the independent assessment is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H), so there is no remote or unauthenticated network trigger and only encrypted PDFs reach the flawed code path; the impact skews heavily toward availability (VA:H) with limited confidentiality and integrity effects. There is no CISA KEV listing indicating confirmed active exploitation, but the supplied CVSS 4.0 vector carries an exploit-maturity metric of E:P, meaning publicly available exploit code exists at proof-of-concept level. This is a moderate-priority memory-corruption bug, not an urgent one, because delivery requires convincing a user to open a malicious encrypted file locally.
Heap buffer overflow in LibreOffice's WMF graphics import path affects documents embedding a crafted Windows Metafile, allowing a local attacker to corrupt memory when the victim opens the file. The flaw arises in a text record that carries its own character advance widths, where the count of advance values and the text length are read independently and need not agree, so rendering walks the advance array past its end when the array is shorter than the text. No public exploit code has been identified at time of analysis, and the impact profile is crash-dominant (confidentiality and integrity Low, availability High), making realistic outcomes denial of service rather than reliable code execution. EPSS is not provided, but exploitation requires the victim to open a malicious document (AV:L, UI:P), so real-world priority is assessed as low despite the MEDIUM CVSS of 5.4.
Heap buffer overflow in LibreOffice Calc's tracked-changes importer allows an attacker who delivers a maliciously crafted spreadsheet to corrupt heap memory, causing high-impact availability loss and potentially enabling arbitrary code execution at the victim's privilege level. The vulnerability is triggered when a document reuses the same change identifier for two structurally different change types, causing the importer to misidentify object size and write past the allocation boundary. A proof-of-concept exists (CVSS 4.0 E:P modifier); no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Heap buffer overflow in LibreOffice Calc's formula compiler allows an attacker to trigger an out-of-bounds write by crafting a spreadsheet containing a formula with extreme nesting depth composed of many consecutive opening tokens. The vulnerability stems from an off-by-one allocation error in the nesting-depth tracking array, causing a single-element write past the buffer's end during file parsing. The CVSS 4.0 vector carries an E:P modifier indicating a proof-of-concept exists; no public exploit identified at time of analysis beyond the POC, and the vulnerability is not listed in CISA KEV.
Stack buffer overflow in LibreOffice's legacy binary PPT importer allows a crafted presentation file to corrupt stack memory, causing application crash or potential arbitrary code execution under the victim's user context. The flaw affects all LibreOffice versions when importing PPT files containing a colour-replacement record whose combined colour counts across two parsing passes exceed the fixed-size stack-allocated colour tables. No public exploit has been confirmed actively exploited (not in CISA KEV), though the CVSS 4.0 supplemental E:P metric indicates proof-of-concept code exists, elevating this above a purely theoretical risk.
Heap buffer overflow in LibreOffice's OOXML (DOCX) import component allows a specially crafted document to corrupt memory when processing text box elements, with high availability impact and limited confidentiality and integrity exposure. The flaw stems from a type confusion during deferred parser event replay: a handler object assumed to be a larger type is written to at that type's field layout, but the actual object may be smaller, causing the write to land past the end of the heap allocation. A proof-of-concept exploit exists (CVSS 4.0 E:P); no confirmed active exploitation is recorded in CISA KEV at time of analysis.
Heap buffer overflow in LibreOffice's EMF+ graphics importer enables memory corruption when a user opens a specially crafted document containing a malicious gradient brush. The root cause is an integer overflow in the multiplication used to compute a heap allocation size from an attacker-controlled gradient blend point count - resulting in an undersized buffer that is subsequently written as if it were full-sized. A proof of concept exists (CVSS 4.0 E:P supplemental metric), no confirmed active exploitation is recorded, and impact spans process crash to potential arbitrary code execution within the LibreOffice session.
Heap use-after-free in LibreOffice's ODF number format parser allows memory corruption when a user opens a crafted document containing a malformed number format string. The flaw arises because a position value embedded in the document is consumed without validation against the actual length of the format-code string, causing the parser to reference stale or out-of-bounds heap memory. Publicly available exploit code exists (CVSS 4.0 E:P), and while no active exploitation is confirmed via CISA KEV, the low attack complexity and document-phishing delivery model make this a realistic targeted threat.
Heap buffer overflow in LibreOffice's DXF import engine allows a crafted CAD file to corrupt process memory when a polyline with more than 65,535 points is parsed. The root cause is an integer truncation defect: the point count read from the DXF file is narrowed to a 16-bit value when sizing the heap allocation, but the original, un-truncated count drives the subsequent write loop - any polyline exceeding 65,535 points overflows the undersized buffer. A proof-of-concept exists (CVSS 4.0 E:P), exploitation requires passive user interaction (opening a malicious DXF file), and no active exploitation has been confirmed in CISA KEV at time of analysis.
Out-of-bounds write in LibreOffice 26.2 before 26.2.3 and 25.8 before 25.8.7 allows local attackers to cause memory corruption and availability impact by opening crafted OOXML documents with mismatched encryption salt parameters. The vulnerability requires user interaction to open a malicious document and affects memory integrity with elevated scope impact on availability.
LibreOffice on macOS 25.2 up to (but not including) 25.2.4 bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions the user previously granted to the LibreOffice application bundle, so an attacker who can already execute binaries locally can launch that interpreter directly and run scripts under the application's TCC privileges - for example the same Full Disk Access, Documents, contacts, or camera scope the user approved for LibreOffice. The payoff is bounded entirely by pre-existing TCC grants: if the user never granted LibreOffice any sensitive TCC scope, there is nothing to inherit, which is why the vendor's CVSS 4.0 vector carries Attack Requirements: Present and scores only 0.9, and our independent assessment rates this as a genuinely low-priority, locally-scoped confidentiality issue (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), with no integrity or availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.14% (3rd percentile), so exploitation is not observed in the wild. Linux and Windows builds of LibreOffice are unaffected.
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. Rated low severity (CVSS 2.4), this vulnerability is low attack complexity. No vendor patch available.
An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required.
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. Rated high severity (CVSS 7.2), this vulnerability is no authentication required. No vendor patch available.
Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.8 before < 24.8.5. Rated high severity (CVSS 7.2), this vulnerability is no authentication required. No vendor patch available.
Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. Rated low severity (CVSS 2.4), this vulnerability is low attack complexity. No vendor patch available.
Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOffice2 before < 24.2.5. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Certificate Validation user interface in LibreOffice allows potential vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in the Libreoffice package. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ODF documents can contain forms to be filled out by the user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice documents can contain macros. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function in vcl/source/gdi/svmconverter.cxx. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Epss exploitation probability 35.6% and no vendor patch available.
Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Epss exploitation probability 22.8% and no vendor patch available.
Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Epss exploitation probability 49.6% and no vendor patch available.
LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Use-after-free vulnerability in the socket manager of Impress Remote in LibreOffice 4.x before 4.2.7 and 4.3.x before 4.3.3 allows remote attackers to cause a denial of service (crash) or possibly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
The OLE preview generation in Apache OpenOffice before 4.1.1 and OpenOffice.org (OOo) might allow remote attackers to embed arbitrary data into documents via crafted OLE objects. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 10.7% and no vendor patch available.
LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to doc/docmacromode.cxx. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Remote code execution in LibreOffice Calc allows attackers to execute arbitrary Java code by embedding a crafted external data link that loads a malicious Java database driver from a remote URL when the document is opened. This affects LibreOffice versions prior to the fix that enforces file URLs for Java class-path entries. Exploitation requires user interaction (opening the document) and a local attack vector; no public exploit has been identified at time of analysis, yet the high-severity impact can fully compromise the user's system.
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Environment-variable and INI-file value disclosure in LibreOffice lets a crafted document exfiltrate host configuration data to a remote server when the victim opens it, because document-supplied URLs can still be expanded in code paths that the earlier CVE-2024-12426 fix missed. The incomplete fix overlooked XForms instance data and the Calc CSV and SQL data providers, which continue to resolve internal-scheme URLs originating from the document. This is a moderate-severity, confidentiality-only flaw (CVSS 4.0 base 6.7, CWE-200) that requires the victim to open an attacker-supplied file, with no public exploit identified at time of analysis; the independent assessment scores it as a local-vector, passive-user-interaction issue with no impact on integrity or availability.
Server-side request forgery in LibreOffice on Linux can expose local files and internal or remote URLs when a document links to a crafted HLS media playlist and the victim opens it and permits link updates. LibreOffice relies on the GStreamer media backend on Linux to play linked audio and video; a malicious playlist's listed resources were fetched while the document loaded and their contents could be written into the document, yielding confidentiality impact (VC:H, SC:H) with no integrity or availability impact in the assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N). The issue is moderate severity and interaction-dependent rather than an urgent priority; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and exploitation is constrained to Linux installations using the GStreamer backend.
Opening a crafted LibreOffice Calc document can cause a local text file on the victim's machine to be read into the spreadsheet, leaking its contents to anyone who later views or receives the file. The document must embed a saved external data link of the sql type that points at a local folder of text files as a database; vulnerable versions automatically restore that link at load time, whereas fixed versions restore only the csv, html and xml data providers. Exploitation requires the victim to open the attacker-supplied document (user interaction, UI:P in the vendor's CVSS 4.0 vector of 6.7, and UI:R in the independent CVSS 3.1 assessment), so exposure is limited to targeted social-engineering scenarios where the attacker also knows or guesses a useful local path and has a way to retrieve the populated sheet; no public exploit identified at time of analysis and the issue is not in CISA KEV.
LibreOffice Calc on affected versions automatically fetched external CSV data links embedded in a spreadsheet while the document loaded, so an attacker-crafted Calc file could read a local file into a sheet or force a request to a host of the document author's choosing (SSRF, CWE-918). Exploitation is local and interaction-gated - the attacker must deliver the malicious document and the victim must open it - and the flaw affects confidentiality only, with no impact on integrity or availability. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor addressed it by placing external data links under the same link-update control that governs other spreadsheet links.
LibreOffice Calc fails to confine file operations when processing an external data-source link to an embedded Firebird database, allowing a crafted document to write files to any location the user has write permission to. Exploitation requires the victim to open the malicious spreadsheet (user interaction) and does not by itself escalate privileges; no public exploit or active exploitation has been identified at time of analysis. The vulnerability is a moderate-severity, user-interaction-dependent file-write issue (CVSS 6.8) rather than a high-priority remote threat.
An out-of-bounds read in LibreOffice's PICT image import path allows a crafted PICT image - one whose stored palette index exceeds the number of entries in its colour palette - to read memory past the end of the palette buffer, crashing the application and potentially disclosing a small amount of adjacent heap memory. Exploitation requires a victim to locally open a document or image that embeds the malicious PICT file; no authentication or non-default configuration is required because PICT import is a standard feature, and the assessed CVSS vector carries an Exploit Maturity of Proof-of-Concept (E:P), indicating proof-of-concept exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this as a moderate-severity, denial-of-service-oriented client-side memory-safety bug (CVSS 3.1 base 5.4-equivalent, AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) rather than a high-priority remotely exploitable flaw.
Information disclosure in LibreOffice allows a crafted document containing hyperlinks to cause local environment-variable and INI-file values to be expanded into the URL and exfiltrated to a remote server when the victim opens the file. The flaw is an incomplete fix for CVE-2024-12426: the earlier guard matched only some ways of naming the package content provider, so a URL naming it differently still reached the expansion logic, whereas fixed builds match the provider during URL checking. Exploitation requires the victim to open an attacker-supplied document (UI:R / UI:P) on the local attack vector, there is no public exploit identified at time of analysis, and the primary impact is confidentiality only (no integrity or availability loss).
Stack buffer overflow in LibreOffice's font subsetting path can crash the application and corrupt memory when a document containing an embedded CFF font is exported to PDF. The vulnerable routine converts CFF (Compact Font Format) glyphs to Type 1 operators during subsetting and writes them into a fixed-size stack buffer without verifying remaining capacity, so a glyph that emits many operators overflows the buffer (CWE-787). Exploitation is local and requires the victim to open an attacker-supplied document and trigger the subsetting code path (typically a PDF export); the CVSS v4.0 base score is 5.4 with PR:N and UI:P, and despite a proof-of-concept maturity rating (E:P) indicating publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV). The most likely outcome is an application crash (VA:H) with limited confidentiality and integrity impact; headless or server-side document-to-PDF conversion services that ingest untrusted files are the highest-risk deployment mode.
Stack-based out-of-bounds write in LibreOffice's CFF font hint parser allows an attacker to corrupt memory and crash the application when a victim opens a document that embeds a maliciously crafted font. Affected are LibreOffice versions before the fix that checks the hint count against the array's actual capacity; exploitation requires the victim to open the crafted file (local vector, user interaction) and no authentication, with confirmed impact limited to a crash plus limited confidentiality/integrity effects-reliable arbitrary code execution is not demonstrated. No CISA KEV listing indicates active exploitation, but the CVSS 4.0 exploit maturity metric E:P indicates publicly available exploit code exists, so patching should be prioritized for users who handle untrusted documents.
Heap buffer overflow in LibreOffice Draw's PDF import path allows a crafted PDF to corrupt heap memory and crash the application when a victim opens or imports the document; the independent assessment rates confidentiality and integrity impact as low but availability impact as high, making denial of service the most realistic outcome. Exploitation requires local delivery and mandatory user interaction, and no authentication or non-default configuration is needed because PDF import is a standard feature. Publicly available exploit code exists per the CVSS 4.0 E:P metric, but there is no confirmed active exploitation (no CISA KEV entry); no EPSS score was provided.
Heap-based buffer overflow in LibreOffice's PDF import filter, reachable through LibreOffice Draw, can crash the application or corrupt heap memory when a victim opens a specially crafted encrypted PDF whose encryption dictionary declares a decryption-key length larger than the fixed-size key buffer the importer fills. Exploitation is local and requires user interaction (AV:L, UI:P/UI:R, PR:N per the CVSS 4.0 vector; the independent assessment is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H), so there is no remote or unauthenticated network trigger and only encrypted PDFs reach the flawed code path; the impact skews heavily toward availability (VA:H) with limited confidentiality and integrity effects. There is no CISA KEV listing indicating confirmed active exploitation, but the supplied CVSS 4.0 vector carries an exploit-maturity metric of E:P, meaning publicly available exploit code exists at proof-of-concept level. This is a moderate-priority memory-corruption bug, not an urgent one, because delivery requires convincing a user to open a malicious encrypted file locally.
Heap buffer overflow in LibreOffice's WMF graphics import path affects documents embedding a crafted Windows Metafile, allowing a local attacker to corrupt memory when the victim opens the file. The flaw arises in a text record that carries its own character advance widths, where the count of advance values and the text length are read independently and need not agree, so rendering walks the advance array past its end when the array is shorter than the text. No public exploit code has been identified at time of analysis, and the impact profile is crash-dominant (confidentiality and integrity Low, availability High), making realistic outcomes denial of service rather than reliable code execution. EPSS is not provided, but exploitation requires the victim to open a malicious document (AV:L, UI:P), so real-world priority is assessed as low despite the MEDIUM CVSS of 5.4.
Heap buffer overflow in LibreOffice Calc's tracked-changes importer allows an attacker who delivers a maliciously crafted spreadsheet to corrupt heap memory, causing high-impact availability loss and potentially enabling arbitrary code execution at the victim's privilege level. The vulnerability is triggered when a document reuses the same change identifier for two structurally different change types, causing the importer to misidentify object size and write past the allocation boundary. A proof-of-concept exists (CVSS 4.0 E:P modifier); no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Heap buffer overflow in LibreOffice Calc's formula compiler allows an attacker to trigger an out-of-bounds write by crafting a spreadsheet containing a formula with extreme nesting depth composed of many consecutive opening tokens. The vulnerability stems from an off-by-one allocation error in the nesting-depth tracking array, causing a single-element write past the buffer's end during file parsing. The CVSS 4.0 vector carries an E:P modifier indicating a proof-of-concept exists; no public exploit identified at time of analysis beyond the POC, and the vulnerability is not listed in CISA KEV.
Stack buffer overflow in LibreOffice's legacy binary PPT importer allows a crafted presentation file to corrupt stack memory, causing application crash or potential arbitrary code execution under the victim's user context. The flaw affects all LibreOffice versions when importing PPT files containing a colour-replacement record whose combined colour counts across two parsing passes exceed the fixed-size stack-allocated colour tables. No public exploit has been confirmed actively exploited (not in CISA KEV), though the CVSS 4.0 supplemental E:P metric indicates proof-of-concept code exists, elevating this above a purely theoretical risk.
Heap buffer overflow in LibreOffice's OOXML (DOCX) import component allows a specially crafted document to corrupt memory when processing text box elements, with high availability impact and limited confidentiality and integrity exposure. The flaw stems from a type confusion during deferred parser event replay: a handler object assumed to be a larger type is written to at that type's field layout, but the actual object may be smaller, causing the write to land past the end of the heap allocation. A proof-of-concept exploit exists (CVSS 4.0 E:P); no confirmed active exploitation is recorded in CISA KEV at time of analysis.
Heap buffer overflow in LibreOffice's EMF+ graphics importer enables memory corruption when a user opens a specially crafted document containing a malicious gradient brush. The root cause is an integer overflow in the multiplication used to compute a heap allocation size from an attacker-controlled gradient blend point count - resulting in an undersized buffer that is subsequently written as if it were full-sized. A proof of concept exists (CVSS 4.0 E:P supplemental metric), no confirmed active exploitation is recorded, and impact spans process crash to potential arbitrary code execution within the LibreOffice session.
Heap use-after-free in LibreOffice's ODF number format parser allows memory corruption when a user opens a crafted document containing a malformed number format string. The flaw arises because a position value embedded in the document is consumed without validation against the actual length of the format-code string, causing the parser to reference stale or out-of-bounds heap memory. Publicly available exploit code exists (CVSS 4.0 E:P), and while no active exploitation is confirmed via CISA KEV, the low attack complexity and document-phishing delivery model make this a realistic targeted threat.
Heap buffer overflow in LibreOffice's DXF import engine allows a crafted CAD file to corrupt process memory when a polyline with more than 65,535 points is parsed. The root cause is an integer truncation defect: the point count read from the DXF file is narrowed to a 16-bit value when sizing the heap allocation, but the original, un-truncated count drives the subsequent write loop - any polyline exceeding 65,535 points overflows the undersized buffer. A proof-of-concept exists (CVSS 4.0 E:P), exploitation requires passive user interaction (opening a malicious DXF file), and no active exploitation has been confirmed in CISA KEV at time of analysis.
Out-of-bounds write in LibreOffice 26.2 before 26.2.3 and 25.8 before 25.8.7 allows local attackers to cause memory corruption and availability impact by opening crafted OOXML documents with mismatched encryption salt parameters. The vulnerability requires user interaction to open a malicious document and affects memory integrity with elevated scope impact on availability.
LibreOffice on macOS 25.2 up to (but not including) 25.2.4 bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions the user previously granted to the LibreOffice application bundle, so an attacker who can already execute binaries locally can launch that interpreter directly and run scripts under the application's TCC privileges - for example the same Full Disk Access, Documents, contacts, or camera scope the user approved for LibreOffice. The payoff is bounded entirely by pre-existing TCC grants: if the user never granted LibreOffice any sensitive TCC scope, there is nothing to inherit, which is why the vendor's CVSS 4.0 vector carries Attack Requirements: Present and scores only 0.9, and our independent assessment rates this as a genuinely low-priority, locally-scoped confidentiality issue (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), with no integrity or availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.14% (3rd percentile), so exploitation is not observed in the wild. Linux and Windows builds of LibreOffice are unaffected.
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. Rated low severity (CVSS 2.4), this vulnerability is low attack complexity. No vendor patch available.
An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required.
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. Rated high severity (CVSS 7.2), this vulnerability is no authentication required. No vendor patch available.
Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.8 before < 24.8.5. Rated high severity (CVSS 7.2), this vulnerability is no authentication required. No vendor patch available.
Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. Rated low severity (CVSS 2.4), this vulnerability is low attack complexity. No vendor patch available.
Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOffice2 before < 24.2.5. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Certificate Validation user interface in LibreOffice allows potential vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in the Libreoffice package. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ODF documents can contain forms to be filled out by the user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice documents can contain macros. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function in vcl/source/gdi/svmconverter.cxx. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Epss exploitation probability 35.6% and no vendor patch available.
Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Epss exploitation probability 22.8% and no vendor patch available.
Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Epss exploitation probability 49.6% and no vendor patch available.
LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Use-after-free vulnerability in the socket manager of Impress Remote in LibreOffice 4.x before 4.2.7 and 4.3.x before 4.3.3 allows remote attackers to cause a denial of service (crash) or possibly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
The OLE preview generation in Apache OpenOffice before 4.1.1 and OpenOffice.org (OOo) might allow remote attackers to embed arbitrary data into documents via crafted OLE objects. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 10.7% and no vendor patch available.
LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to doc/docmacromode.cxx. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.