The Document Foundation
Monthly
Remote code execution in LibreOffice Calc allows attackers to execute arbitrary Java code by embedding a crafted external data link that loads a malicious Java database driver from a remote URL when the document is opened. This affects LibreOffice versions prior to the fix that enforces file URLs for Java class-path entries. Exploitation requires user interaction (opening the document) and a local attack vector; no public exploit has been identified at time of analysis, yet the high-severity impact can fully compromise the user's system.
Environment-variable and INI-file value disclosure in LibreOffice lets a crafted document exfiltrate host configuration data to a remote server when the victim opens it, because document-supplied URLs can still be expanded in code paths that the earlier CVE-2024-12426 fix missed. The incomplete fix overlooked XForms instance data and the Calc CSV and SQL data providers, which continue to resolve internal-scheme URLs originating from the document. This is a moderate-severity, confidentiality-only flaw (CVSS 4.0 base 6.7, CWE-200) that requires the victim to open an attacker-supplied file, with no public exploit identified at time of analysis; the independent assessment scores it as a local-vector, passive-user-interaction issue with no impact on integrity or availability.
Server-side request forgery in LibreOffice on Linux can expose local files and internal or remote URLs when a document links to a crafted HLS media playlist and the victim opens it and permits link updates. LibreOffice relies on the GStreamer media backend on Linux to play linked audio and video; a malicious playlist's listed resources were fetched while the document loaded and their contents could be written into the document, yielding confidentiality impact (VC:H, SC:H) with no integrity or availability impact in the assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N). The issue is moderate severity and interaction-dependent rather than an urgent priority; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and exploitation is constrained to Linux installations using the GStreamer backend.
Opening a crafted LibreOffice Calc document can cause a local text file on the victim's machine to be read into the spreadsheet, leaking its contents to anyone who later views or receives the file. The document must embed a saved external data link of the sql type that points at a local folder of text files as a database; vulnerable versions automatically restore that link at load time, whereas fixed versions restore only the csv, html and xml data providers. Exploitation requires the victim to open the attacker-supplied document (user interaction, UI:P in the vendor's CVSS 4.0 vector of 6.7, and UI:R in the independent CVSS 3.1 assessment), so exposure is limited to targeted social-engineering scenarios where the attacker also knows or guesses a useful local path and has a way to retrieve the populated sheet; no public exploit identified at time of analysis and the issue is not in CISA KEV.
LibreOffice Calc on affected versions automatically fetched external CSV data links embedded in a spreadsheet while the document loaded, so an attacker-crafted Calc file could read a local file into a sheet or force a request to a host of the document author's choosing (SSRF, CWE-918). Exploitation is local and interaction-gated - the attacker must deliver the malicious document and the victim must open it - and the flaw affects confidentiality only, with no impact on integrity or availability. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor addressed it by placing external data links under the same link-update control that governs other spreadsheet links.
LibreOffice Calc fails to confine file operations when processing an external data-source link to an embedded Firebird database, allowing a crafted document to write files to any location the user has write permission to. Exploitation requires the victim to open the malicious spreadsheet (user interaction) and does not by itself escalate privileges; no public exploit or active exploitation has been identified at time of analysis. The vulnerability is a moderate-severity, user-interaction-dependent file-write issue (CVSS 6.8) rather than a high-priority remote threat.
An out-of-bounds read in LibreOffice's PICT image import path allows a crafted PICT image - one whose stored palette index exceeds the number of entries in its colour palette - to read memory past the end of the palette buffer, crashing the application and potentially disclosing a small amount of adjacent heap memory. Exploitation requires a victim to locally open a document or image that embeds the malicious PICT file; no authentication or non-default configuration is required because PICT import is a standard feature, and the assessed CVSS vector carries an Exploit Maturity of Proof-of-Concept (E:P), indicating proof-of-concept exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this as a moderate-severity, denial-of-service-oriented client-side memory-safety bug (CVSS 3.1 base 5.4-equivalent, AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) rather than a high-priority remotely exploitable flaw.
Information disclosure in LibreOffice allows a crafted document containing hyperlinks to cause local environment-variable and INI-file values to be expanded into the URL and exfiltrated to a remote server when the victim opens the file. The flaw is an incomplete fix for CVE-2024-12426: the earlier guard matched only some ways of naming the package content provider, so a URL naming it differently still reached the expansion logic, whereas fixed builds match the provider during URL checking. Exploitation requires the victim to open an attacker-supplied document (UI:R / UI:P) on the local attack vector, there is no public exploit identified at time of analysis, and the primary impact is confidentiality only (no integrity or availability loss).
Stack buffer overflow in LibreOffice's font subsetting path can crash the application and corrupt memory when a document containing an embedded CFF font is exported to PDF. The vulnerable routine converts CFF (Compact Font Format) glyphs to Type 1 operators during subsetting and writes them into a fixed-size stack buffer without verifying remaining capacity, so a glyph that emits many operators overflows the buffer (CWE-787). Exploitation is local and requires the victim to open an attacker-supplied document and trigger the subsetting code path (typically a PDF export); the CVSS v4.0 base score is 5.4 with PR:N and UI:P, and despite a proof-of-concept maturity rating (E:P) indicating publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV). The most likely outcome is an application crash (VA:H) with limited confidentiality and integrity impact; headless or server-side document-to-PDF conversion services that ingest untrusted files are the highest-risk deployment mode.
Stack-based out-of-bounds write in LibreOffice's CFF font hint parser allows an attacker to corrupt memory and crash the application when a victim opens a document that embeds a maliciously crafted font. Affected are LibreOffice versions before the fix that checks the hint count against the array's actual capacity; exploitation requires the victim to open the crafted file (local vector, user interaction) and no authentication, with confirmed impact limited to a crash plus limited confidentiality/integrity effects-reliable arbitrary code execution is not demonstrated. No CISA KEV listing indicates active exploitation, but the CVSS 4.0 exploit maturity metric E:P indicates publicly available exploit code exists, so patching should be prioritized for users who handle untrusted documents.
Heap buffer overflow in LibreOffice Draw's PDF import path allows a crafted PDF to corrupt heap memory and crash the application when a victim opens or imports the document; the independent assessment rates confidentiality and integrity impact as low but availability impact as high, making denial of service the most realistic outcome. Exploitation requires local delivery and mandatory user interaction, and no authentication or non-default configuration is needed because PDF import is a standard feature. Publicly available exploit code exists per the CVSS 4.0 E:P metric, but there is no confirmed active exploitation (no CISA KEV entry); no EPSS score was provided.
Heap-based buffer overflow in LibreOffice's PDF import filter, reachable through LibreOffice Draw, can crash the application or corrupt heap memory when a victim opens a specially crafted encrypted PDF whose encryption dictionary declares a decryption-key length larger than the fixed-size key buffer the importer fills. Exploitation is local and requires user interaction (AV:L, UI:P/UI:R, PR:N per the CVSS 4.0 vector; the independent assessment is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H), so there is no remote or unauthenticated network trigger and only encrypted PDFs reach the flawed code path; the impact skews heavily toward availability (VA:H) with limited confidentiality and integrity effects. There is no CISA KEV listing indicating confirmed active exploitation, but the supplied CVSS 4.0 vector carries an exploit-maturity metric of E:P, meaning publicly available exploit code exists at proof-of-concept level. This is a moderate-priority memory-corruption bug, not an urgent one, because delivery requires convincing a user to open a malicious encrypted file locally.
Heap buffer overflow in LibreOffice's WMF graphics import path affects documents embedding a crafted Windows Metafile, allowing a local attacker to corrupt memory when the victim opens the file. The flaw arises in a text record that carries its own character advance widths, where the count of advance values and the text length are read independently and need not agree, so rendering walks the advance array past its end when the array is shorter than the text. No public exploit code has been identified at time of analysis, and the impact profile is crash-dominant (confidentiality and integrity Low, availability High), making realistic outcomes denial of service rather than reliable code execution. EPSS is not provided, but exploitation requires the victim to open a malicious document (AV:L, UI:P), so real-world priority is assessed as low despite the MEDIUM CVSS of 5.4.
Heap buffer overflow in LibreOffice Calc's tracked-changes importer allows an attacker who delivers a maliciously crafted spreadsheet to corrupt heap memory, causing high-impact availability loss and potentially enabling arbitrary code execution at the victim's privilege level. The vulnerability is triggered when a document reuses the same change identifier for two structurally different change types, causing the importer to misidentify object size and write past the allocation boundary. A proof-of-concept exists (CVSS 4.0 E:P modifier); no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Heap buffer overflow in LibreOffice Calc's formula compiler allows an attacker to trigger an out-of-bounds write by crafting a spreadsheet containing a formula with extreme nesting depth composed of many consecutive opening tokens. The vulnerability stems from an off-by-one allocation error in the nesting-depth tracking array, causing a single-element write past the buffer's end during file parsing. The CVSS 4.0 vector carries an E:P modifier indicating a proof-of-concept exists; no public exploit identified at time of analysis beyond the POC, and the vulnerability is not listed in CISA KEV.
Stack buffer overflow in LibreOffice's legacy binary PPT importer allows a crafted presentation file to corrupt stack memory, causing application crash or potential arbitrary code execution under the victim's user context. The flaw affects all LibreOffice versions when importing PPT files containing a colour-replacement record whose combined colour counts across two parsing passes exceed the fixed-size stack-allocated colour tables. No public exploit has been confirmed actively exploited (not in CISA KEV), though the CVSS 4.0 supplemental E:P metric indicates proof-of-concept code exists, elevating this above a purely theoretical risk.
Heap buffer overflow in LibreOffice's OOXML (DOCX) import component allows a specially crafted document to corrupt memory when processing text box elements, with high availability impact and limited confidentiality and integrity exposure. The flaw stems from a type confusion during deferred parser event replay: a handler object assumed to be a larger type is written to at that type's field layout, but the actual object may be smaller, causing the write to land past the end of the heap allocation. A proof-of-concept exploit exists (CVSS 4.0 E:P); no confirmed active exploitation is recorded in CISA KEV at time of analysis.
Heap buffer overflow in LibreOffice's EMF+ graphics importer enables memory corruption when a user opens a specially crafted document containing a malicious gradient brush. The root cause is an integer overflow in the multiplication used to compute a heap allocation size from an attacker-controlled gradient blend point count - resulting in an undersized buffer that is subsequently written as if it were full-sized. A proof of concept exists (CVSS 4.0 E:P supplemental metric), no confirmed active exploitation is recorded, and impact spans process crash to potential arbitrary code execution within the LibreOffice session.
Heap use-after-free in LibreOffice's ODF number format parser allows memory corruption when a user opens a crafted document containing a malformed number format string. The flaw arises because a position value embedded in the document is consumed without validation against the actual length of the format-code string, causing the parser to reference stale or out-of-bounds heap memory. Publicly available exploit code exists (CVSS 4.0 E:P), and while no active exploitation is confirmed via CISA KEV, the low attack complexity and document-phishing delivery model make this a realistic targeted threat.
Heap buffer overflow in LibreOffice's DXF import engine allows a crafted CAD file to corrupt process memory when a polyline with more than 65,535 points is parsed. The root cause is an integer truncation defect: the point count read from the DXF file is narrowed to a 16-bit value when sizing the heap allocation, but the original, un-truncated count drives the subsequent write loop - any polyline exceeding 65,535 points overflows the undersized buffer. A proof-of-concept exists (CVSS 4.0 E:P), exploitation requires passive user interaction (opening a malicious DXF file), and no active exploitation has been confirmed in CISA KEV at time of analysis.
Out-of-bounds write in LibreOffice 26.2 before 26.2.3 and 25.8 before 25.8.7 allows local attackers to cause memory corruption and availability impact by opening crafted OOXML documents with mismatched encryption salt parameters. The vulnerability requires user interaction to open a malicious document and affects memory integrity with elevated scope impact on availability.
Remote code execution in LibreOffice Calc allows attackers to execute arbitrary Java code by embedding a crafted external data link that loads a malicious Java database driver from a remote URL when the document is opened. This affects LibreOffice versions prior to the fix that enforces file URLs for Java class-path entries. Exploitation requires user interaction (opening the document) and a local attack vector; no public exploit has been identified at time of analysis, yet the high-severity impact can fully compromise the user's system.
Environment-variable and INI-file value disclosure in LibreOffice lets a crafted document exfiltrate host configuration data to a remote server when the victim opens it, because document-supplied URLs can still be expanded in code paths that the earlier CVE-2024-12426 fix missed. The incomplete fix overlooked XForms instance data and the Calc CSV and SQL data providers, which continue to resolve internal-scheme URLs originating from the document. This is a moderate-severity, confidentiality-only flaw (CVSS 4.0 base 6.7, CWE-200) that requires the victim to open an attacker-supplied file, with no public exploit identified at time of analysis; the independent assessment scores it as a local-vector, passive-user-interaction issue with no impact on integrity or availability.
Server-side request forgery in LibreOffice on Linux can expose local files and internal or remote URLs when a document links to a crafted HLS media playlist and the victim opens it and permits link updates. LibreOffice relies on the GStreamer media backend on Linux to play linked audio and video; a malicious playlist's listed resources were fetched while the document loaded and their contents could be written into the document, yielding confidentiality impact (VC:H, SC:H) with no integrity or availability impact in the assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N). The issue is moderate severity and interaction-dependent rather than an urgent priority; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and exploitation is constrained to Linux installations using the GStreamer backend.
Opening a crafted LibreOffice Calc document can cause a local text file on the victim's machine to be read into the spreadsheet, leaking its contents to anyone who later views or receives the file. The document must embed a saved external data link of the sql type that points at a local folder of text files as a database; vulnerable versions automatically restore that link at load time, whereas fixed versions restore only the csv, html and xml data providers. Exploitation requires the victim to open the attacker-supplied document (user interaction, UI:P in the vendor's CVSS 4.0 vector of 6.7, and UI:R in the independent CVSS 3.1 assessment), so exposure is limited to targeted social-engineering scenarios where the attacker also knows or guesses a useful local path and has a way to retrieve the populated sheet; no public exploit identified at time of analysis and the issue is not in CISA KEV.
LibreOffice Calc on affected versions automatically fetched external CSV data links embedded in a spreadsheet while the document loaded, so an attacker-crafted Calc file could read a local file into a sheet or force a request to a host of the document author's choosing (SSRF, CWE-918). Exploitation is local and interaction-gated - the attacker must deliver the malicious document and the victim must open it - and the flaw affects confidentiality only, with no impact on integrity or availability. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor addressed it by placing external data links under the same link-update control that governs other spreadsheet links.
LibreOffice Calc fails to confine file operations when processing an external data-source link to an embedded Firebird database, allowing a crafted document to write files to any location the user has write permission to. Exploitation requires the victim to open the malicious spreadsheet (user interaction) and does not by itself escalate privileges; no public exploit or active exploitation has been identified at time of analysis. The vulnerability is a moderate-severity, user-interaction-dependent file-write issue (CVSS 6.8) rather than a high-priority remote threat.
An out-of-bounds read in LibreOffice's PICT image import path allows a crafted PICT image - one whose stored palette index exceeds the number of entries in its colour palette - to read memory past the end of the palette buffer, crashing the application and potentially disclosing a small amount of adjacent heap memory. Exploitation requires a victim to locally open a document or image that embeds the malicious PICT file; no authentication or non-default configuration is required because PICT import is a standard feature, and the assessed CVSS vector carries an Exploit Maturity of Proof-of-Concept (E:P), indicating proof-of-concept exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this as a moderate-severity, denial-of-service-oriented client-side memory-safety bug (CVSS 3.1 base 5.4-equivalent, AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) rather than a high-priority remotely exploitable flaw.
Information disclosure in LibreOffice allows a crafted document containing hyperlinks to cause local environment-variable and INI-file values to be expanded into the URL and exfiltrated to a remote server when the victim opens the file. The flaw is an incomplete fix for CVE-2024-12426: the earlier guard matched only some ways of naming the package content provider, so a URL naming it differently still reached the expansion logic, whereas fixed builds match the provider during URL checking. Exploitation requires the victim to open an attacker-supplied document (UI:R / UI:P) on the local attack vector, there is no public exploit identified at time of analysis, and the primary impact is confidentiality only (no integrity or availability loss).
Stack buffer overflow in LibreOffice's font subsetting path can crash the application and corrupt memory when a document containing an embedded CFF font is exported to PDF. The vulnerable routine converts CFF (Compact Font Format) glyphs to Type 1 operators during subsetting and writes them into a fixed-size stack buffer without verifying remaining capacity, so a glyph that emits many operators overflows the buffer (CWE-787). Exploitation is local and requires the victim to open an attacker-supplied document and trigger the subsetting code path (typically a PDF export); the CVSS v4.0 base score is 5.4 with PR:N and UI:P, and despite a proof-of-concept maturity rating (E:P) indicating publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV). The most likely outcome is an application crash (VA:H) with limited confidentiality and integrity impact; headless or server-side document-to-PDF conversion services that ingest untrusted files are the highest-risk deployment mode.
Stack-based out-of-bounds write in LibreOffice's CFF font hint parser allows an attacker to corrupt memory and crash the application when a victim opens a document that embeds a maliciously crafted font. Affected are LibreOffice versions before the fix that checks the hint count against the array's actual capacity; exploitation requires the victim to open the crafted file (local vector, user interaction) and no authentication, with confirmed impact limited to a crash plus limited confidentiality/integrity effects-reliable arbitrary code execution is not demonstrated. No CISA KEV listing indicates active exploitation, but the CVSS 4.0 exploit maturity metric E:P indicates publicly available exploit code exists, so patching should be prioritized for users who handle untrusted documents.
Heap buffer overflow in LibreOffice Draw's PDF import path allows a crafted PDF to corrupt heap memory and crash the application when a victim opens or imports the document; the independent assessment rates confidentiality and integrity impact as low but availability impact as high, making denial of service the most realistic outcome. Exploitation requires local delivery and mandatory user interaction, and no authentication or non-default configuration is needed because PDF import is a standard feature. Publicly available exploit code exists per the CVSS 4.0 E:P metric, but there is no confirmed active exploitation (no CISA KEV entry); no EPSS score was provided.
Heap-based buffer overflow in LibreOffice's PDF import filter, reachable through LibreOffice Draw, can crash the application or corrupt heap memory when a victim opens a specially crafted encrypted PDF whose encryption dictionary declares a decryption-key length larger than the fixed-size key buffer the importer fills. Exploitation is local and requires user interaction (AV:L, UI:P/UI:R, PR:N per the CVSS 4.0 vector; the independent assessment is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H), so there is no remote or unauthenticated network trigger and only encrypted PDFs reach the flawed code path; the impact skews heavily toward availability (VA:H) with limited confidentiality and integrity effects. There is no CISA KEV listing indicating confirmed active exploitation, but the supplied CVSS 4.0 vector carries an exploit-maturity metric of E:P, meaning publicly available exploit code exists at proof-of-concept level. This is a moderate-priority memory-corruption bug, not an urgent one, because delivery requires convincing a user to open a malicious encrypted file locally.
Heap buffer overflow in LibreOffice's WMF graphics import path affects documents embedding a crafted Windows Metafile, allowing a local attacker to corrupt memory when the victim opens the file. The flaw arises in a text record that carries its own character advance widths, where the count of advance values and the text length are read independently and need not agree, so rendering walks the advance array past its end when the array is shorter than the text. No public exploit code has been identified at time of analysis, and the impact profile is crash-dominant (confidentiality and integrity Low, availability High), making realistic outcomes denial of service rather than reliable code execution. EPSS is not provided, but exploitation requires the victim to open a malicious document (AV:L, UI:P), so real-world priority is assessed as low despite the MEDIUM CVSS of 5.4.
Heap buffer overflow in LibreOffice Calc's tracked-changes importer allows an attacker who delivers a maliciously crafted spreadsheet to corrupt heap memory, causing high-impact availability loss and potentially enabling arbitrary code execution at the victim's privilege level. The vulnerability is triggered when a document reuses the same change identifier for two structurally different change types, causing the importer to misidentify object size and write past the allocation boundary. A proof-of-concept exists (CVSS 4.0 E:P modifier); no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Heap buffer overflow in LibreOffice Calc's formula compiler allows an attacker to trigger an out-of-bounds write by crafting a spreadsheet containing a formula with extreme nesting depth composed of many consecutive opening tokens. The vulnerability stems from an off-by-one allocation error in the nesting-depth tracking array, causing a single-element write past the buffer's end during file parsing. The CVSS 4.0 vector carries an E:P modifier indicating a proof-of-concept exists; no public exploit identified at time of analysis beyond the POC, and the vulnerability is not listed in CISA KEV.
Stack buffer overflow in LibreOffice's legacy binary PPT importer allows a crafted presentation file to corrupt stack memory, causing application crash or potential arbitrary code execution under the victim's user context. The flaw affects all LibreOffice versions when importing PPT files containing a colour-replacement record whose combined colour counts across two parsing passes exceed the fixed-size stack-allocated colour tables. No public exploit has been confirmed actively exploited (not in CISA KEV), though the CVSS 4.0 supplemental E:P metric indicates proof-of-concept code exists, elevating this above a purely theoretical risk.
Heap buffer overflow in LibreOffice's OOXML (DOCX) import component allows a specially crafted document to corrupt memory when processing text box elements, with high availability impact and limited confidentiality and integrity exposure. The flaw stems from a type confusion during deferred parser event replay: a handler object assumed to be a larger type is written to at that type's field layout, but the actual object may be smaller, causing the write to land past the end of the heap allocation. A proof-of-concept exploit exists (CVSS 4.0 E:P); no confirmed active exploitation is recorded in CISA KEV at time of analysis.
Heap buffer overflow in LibreOffice's EMF+ graphics importer enables memory corruption when a user opens a specially crafted document containing a malicious gradient brush. The root cause is an integer overflow in the multiplication used to compute a heap allocation size from an attacker-controlled gradient blend point count - resulting in an undersized buffer that is subsequently written as if it were full-sized. A proof of concept exists (CVSS 4.0 E:P supplemental metric), no confirmed active exploitation is recorded, and impact spans process crash to potential arbitrary code execution within the LibreOffice session.
Heap use-after-free in LibreOffice's ODF number format parser allows memory corruption when a user opens a crafted document containing a malformed number format string. The flaw arises because a position value embedded in the document is consumed without validation against the actual length of the format-code string, causing the parser to reference stale or out-of-bounds heap memory. Publicly available exploit code exists (CVSS 4.0 E:P), and while no active exploitation is confirmed via CISA KEV, the low attack complexity and document-phishing delivery model make this a realistic targeted threat.
Heap buffer overflow in LibreOffice's DXF import engine allows a crafted CAD file to corrupt process memory when a polyline with more than 65,535 points is parsed. The root cause is an integer truncation defect: the point count read from the DXF file is narrowed to a 16-bit value when sizing the heap allocation, but the original, un-truncated count drives the subsequent write loop - any polyline exceeding 65,535 points overflows the undersized buffer. A proof-of-concept exists (CVSS 4.0 E:P), exploitation requires passive user interaction (opening a malicious DXF file), and no active exploitation has been confirmed in CISA KEV at time of analysis.
Out-of-bounds write in LibreOffice 26.2 before 26.2.3 and 25.8 before 25.8.7 allows local attackers to cause memory corruption and availability impact by opening crafted OOXML documents with mismatched encryption salt parameters. The vulnerability requires user interaction to open a malicious document and affects memory integrity with elevated scope impact on availability.