Security

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.

Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to.

In fixed versions an embedded Firebird database can open or create files only inside its own private directory.

All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem.

Thanks to Thomas Rinsma and Edoardo Geraci from Codean Labs for reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Announced : Oct 5, 2026

Fixed in : LibreOffice 26.2.5/26.8.0

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document.

Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document’s choosing.

In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.

All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem.

Thanks to Thomas Rinsma and Edoardo Geraci from Codean Labs for reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Announced : Oct 5, 2026

Fixed in : LibreOffice 26.2.5/26.8.0

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.

A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet.

In fixed versions only the csv, html and xml data providers are restored when a document is loaded.

All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem.

Thanks to Thomas Rinsma and Edoardo Geraci from Codean Labs for reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Announced : Oct 5, 2026

Fixed in : LibreOffice 26.2.5/26.8.0

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer.

A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document.

In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.

All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem.

Thanks to Thomas Rinsma and Edoardo Geraci from Codean Labs for reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Announced : Oct 5, 2026

Fixed in : LibreOffice 26.2.5/26.8.0

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links.

The check added for CVE-2024-12426 did not cover every place a document can supply a URL. XForms instance data and the Calc csv and sql data providers still reached the expansion.

In fixed versions these places refuse URLs with internal schemes when the URL comes from the document.

All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem.

Thanks to Thomas Rinsma and Edoardo Geraci from Codean Labs for reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Announced : Oct 5, 2026

Fixed in : LibreOffice 26.2.5/26.8.0

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.

A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location.

In fixed versions an entry in a Java class path has to be a file URL.

All users are recommended to upgrade to LibreOffice >= 26.2.5 or >= 26.8.0 to avoid this problem.

Thanks to Rick de Jager of the V12 security team, and to Thomas Rinsma and Edoardo Geraci from Codean Labs, for independently reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Addressed in LibreOffice 26.2.5

Announced : Sep 21, 2026

Fixed in : LibreOffice 26.2.5

LibreOffice can import WMF graphics, which may be embedded in documents.

A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to agree, so drawing the text walked the advance array by character position and ran past its end when the array was the shorter of the two.

In fixed versions an advance array shorter than its text is ignored.

All users are recommended to upgrade to LibreOffice >= 26.2.5 to avoid this problem.

Thanks to Claude and Ada Logics – found by Anthropic using agents to study the security of open-source projects, with Ada Logics validating and reporting.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Announced : Sep 21, 2026

Fixed in : LibreOffice 26.2.5

LibreOffice Draw can import PDF documents.

A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document’s own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end.

In fixed versions a declared key length larger than the buffer is rejected.

All users are recommended to upgrade to LibreOffice >= 26.2.5 to avoid this problem.

Thanks to Claude and Ada Logics – found by Anthropic using agents to study the security of open-source projects, with Ada Logics validating and reporting.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Announced : Sep 21, 2026

Fixed in : LibreOffice 26.2.5

LibreOffice Draw can import PDF documents.

A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object’s own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it.

In fixed versions the declared length is clamped to the bytes actually read.

All users are recommended to upgrade to LibreOffice >= 26.2.5 to avoid this problem.

Thanks to Claude and Ada Logics – found by Anthropic using agents to study the security of open-source projects, with Ada Logics validating and reporting.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Announced : Sep 21, 2026

Fixed in : LibreOffice 26.2.5

LibreOffice can read CFF fonts, which may be embedded in documents.

A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end.

In fixed versions the hint count is checked against the capacity the array really has.

All users are recommended to upgrade to LibreOffice >= 26.2.5 to avoid this problem.

Thanks to Claude and Ada Logics – found by Anthropic using agents to study the security of open-source projects, with Ada Logics validating and reporting.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Announced : Sep 21, 2026

Fixed in : LibreOffice 26.2.5

LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents.

A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer.

In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.

All users are recommended to upgrade to LibreOffice >= 26.2.5 to avoid this problem.

Thanks to Claude and Ada Logics – found by Anthropic using agents to study the security of open-source projects, with Ada Logics validating and reporting.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Announced : Sep 21, 2026

Fixed in : LibreOffice 26.2.5

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links.

The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion.

In fixed versions the package content provider is matched when the URL is checked.

All users are recommended to upgrade to LibreOffice >= 26.2.5 to avoid this problem.

Thanks to Darren Xuan of Tanto Security for reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Announced : Sep 21, 2026

Fixed in : LibreOffice 26.2.5

LibreOffice can import PICT images, which may be embedded in documents.

An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the last entry read memory outside the palette.

In fixed versions the palette index is limited to the entries present.

All users are recommended to upgrade to LibreOffice >= 26.2.5 to avoid this problem.

Thanks to Himanshu Anand for reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing the fix.

Addressed in LibreOffice 26.2.4

Announced: Jun 15, 2026

Fixed in: LibreOffice 26.2.4

A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack.

In fixed versions the unused second pass is no longer read into those tables.

All users are recommended to upgrade to LibreOffice >= 26.2.4 to avoid this problem.

Thanks to Anthropic for discovering this issue using automated analysis with Claude.

Thanks to Arthur Chan of Ada Logics for validating and reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

Announced: Jun 15, 2026

Fixed in: LibreOffice 26.2.4

A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end.

In fixed versions the array is sized to hold the largest possible nesting.

All users are recommended to upgrade to LibreOffice >= 26.2.4 to avoid this problem.

Thanks to Anthropic for discovering this issue using automated analysis with Claude.

Thanks to Trail of Bits for triaging and validating this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

Announced: Jun 15, 2026

Fixed in: LibreOffice 26.2.4

LibreOffice Calc can import tracked changes from a spreadsheet document.

A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation.

In fixed versions records with a duplicate identifier are rejected.

All users are recommended to upgrade to LibreOffice >= 26.2.4 to avoid this problem.

Thanks to Anthropic for discovering this issue using automated analysis with Claude.

Thanks to Arthur Chan of Ada Logics for validating and reporting this issue.

Thanks to Caolán McNamara of Collabora for providing the fix.

Addressed in LibreOffice 26.2.3/25.8.7

Announced: Jun 15, 2026

Fixed in: LibreOffice 26.2.3 and LibreOffice 25.8.7

LibreOffice supports a number format option that pads a number with blank space as wide as a chosen character.

A heap use-after-free existed when importing these blank-width characters from an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string.

In fixed versions the position is bounds-checked before use.

All users are recommended to upgrade to LibreOffice >= 26.2.3 or >= 25.8.7 to avoid this problem.

Thanks to Anthropic for discovering this issue using automated analysis with Claude.

Thanks to Trail of Bits for triaging and validating this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

Announced: Jun 15, 2026

Fixed in: LibreOffice 26.2.3 and LibreOffice 25.8.7

LibreOffice can import drawings in the DXF format used by CAD software.

A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a polyline whose point count exceeded the 16-bit range was written past the end of the buffer.

In fixed versions such oversized polylines are rejected.

All users are recommended to upgrade to LibreOffice >= 26.2.3 or >= 25.8.7 to avoid this problem.

Thanks to Anthropic for discovering this issue using automated analysis with Claude.

Thanks to Trail of Bits for triaging and validating this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

Announced: Jun 15, 2026

Fixed in: LibreOffice 26.2.3 and LibreOffice 25.8.7

A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and then filled as if it were large, writing past its end.

In fixed versions the blend-point count is checked against the data actually available before allocating.

All users are recommended to upgrade to LibreOffice >= 26.2.3 or >= 25.8.7 to avoid this problem.

Thanks to Anthropic for discovering this issue using automated analysis with Claude.

Thanks to Trail of Bits for triaging and validating this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

Announced: Jun 15, 2026

Fixed in: LibreOffice 26.2.3 and LibreOffice 25.8.7

A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type’s field layout, but it could be a smaller object, so the write landed past the end of the allocation.

In fixed versions the type is checked before the write.

All users are recommended to upgrade to LibreOffice >= 26.2.3 or >= 25.8.7 to avoid this problem.

Thanks to Anthropic for discovering this issue using automated analysis with Claude.

Thanks to Trail of Bits for triaging and validating this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

Announced: May 06, 2026

Fixed in: LibreOffice 26.2.3 and LibreOffice 25.8.7

Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters.

All users are recommended to upgrade to LibreOffice >= 26.2.3 or >= 25.8.7 to avoid this problem.

Thanks to Duc Anh Nguyen (@Danzation) for finding and reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

Addressed in LibreOffice 25.2.4/25.8.0

Announced: Dec 15, 2025

Fixed in: LibreOffice 25.2.4

LibreOffice typically bundles python to provide scripting support

On macOS, an Authentication Bypass vulnerability existed where the bundled python launcher inheritd the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle.

In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions.

All users are recommended to upgrade to LibreOffice >= 25.2.4 to avoid this problem.

Thanks to Karol Mazurek of AFINE for reporting this issue.

Thanks to Christian Lohmaier of TDF for providing the fix.

Addressed in LibreOffice 24.8.6/25.2.2

Announced: Apr 27, 2025

Fixed in: LibreOffice 24.8.6 and 25.2.2

LibreOffice supports digital signatures when opening PDF documents, presenting information if the signature is valid or not.

In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid

All users are recommended to upgrade to LibreOffice >= 24.8.6 or 25.2.2 to avoid this problem.

Thanks to Juraj Šarinay for discovering this issue and for providing a fix.

Addressed in LibreOffice 24.8.5/25.2.1

Announced: March 4, 2025

Fixed in: LibreOffice 24.8.5 and 25.2.1

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme ‘vnd.libreoffice.command’ specific to LibreOffice was added.

In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments.

In the fixed versions this circumvention has been blocked. All users are recommended to upgrade to LibreOffice >= 24.8.5 or 25.2.1

Thanks to Amel Bouziane-Leblond for finding and reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

Addressed in LibreOffice 24.8.5

Announced: February 25, 2025

Fixed in: LibreOffice 24.8.5

LibreOffice has a feature where hyperlinks in a document can be activated by CTRL+click. Under Windows the link can be passed to the system ShellExecute function for handling. LibreOffice uses a mechanism to block paths to executable targets to ShellExecute to avoid attempting to launch executables.

In versious = 24.8.5.

Thanks to Amel Bouziane-Leblond for finding and reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity and Stephen Bergman of allotropia for providing a fix.

Addressed in LibreOffice 24.8.4

Announced: Jan 7, 2025

Fixed in: LibreOffice 24.8.4

Various file formats can contain embedded font files which are extracted to temporary files which are added to LibreOffice’s font lists.

Prior to this fix, an attacker could craft a document with embedded font file path names which could cause LibreOffice to write the contents of the embedded font to a filename in an arbitrary location the user has permission to write to. Albeit always with a “.ttf” suffix.

Users are recommended to upgrade to 24.8.4 to avoid this issue.

Thanks to Thomas Rinsma of Codean Labs for finding and reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

Announced: Jan 7, 2025

Fixed in: LibreOffice 24.8.4

URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links.

Prior to this fix, documents could include links that made use of an internal feature that expands environmental variables and INI file values in URLS. In the fixed version, the expansion feature is not available in document hosted urls.

Users are recommended to upgrade to 24.8.4 to avoid this issue.

Thanks to Thomas Rinsma of Codean Labs for finding and reporting this issue.

Thanks to Caolán McNamara of Collabora Productivity for providing a fix.

Addressed in LibreOffice 24.8.0/24.2.5

Announced: Sep 17, 2024

Fixed in: LibreOffice 24.2.5 and 24.8.0

Various file formats are based on the zip file format. In cases of corruption of the underlying zip’s central directory, LibreOffice offers a “repair mode” which will attempt to recover the zip file structure by scanning for secondary local file headers in the zip to reconstruct the document.

Prior to this fix, in the case of digitally signed zip files, an attacker could construct a document which, when repaired, reported a signature status not valid for the recovered file.

Previously if verification failed the user could choose to ignore the failure and enable the macros anyway.

Repair document mode has to be inherently tolerant, so now in fixed versions all signatures are implied to be invalid in recovery mode.

Users are recommended to upgrade to 24.2.5 or 24.8.0 to gain this enhacement.

Thanks to Yufan You for finding and reporting this issue.

Thanks to Michael Stahl of allotropia for providing a fix.

Addressed in LibreOffice 24.2.5

Announced: Aug 05, 2024

Fixed in: LibreOffice 24.2.5

Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document with a signed macro is opened a warning is displayed by LibreOffice before the macro is executed.

Previously if verification failed the user could choose to ignore the failure and enable the macros anyway.

Now in High Macro Security mode (the default) LibreOffice automatically disables macros that fail the certificate check.

Users are recommended to upgrade to 24.2.5 to gain this enhacement.

Thanks to OpenSource Security GmbH on behalf of the German Federal Office for Information Security for finding and reporting this issue.

Thanks to Sarper Akdemir of allotropia for providing a fix.

Addressed in LibreOffice 24.2.4

Announced: Jun 25, 2024

Fixed in: LibreOffice 24.2.4

LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents.

LibreOffice internally makes use of “curl” to fetch remote resources such as images hosted on webservers.

In affected versions of LibreOffice, when used in LibreOfficeKit mode only, then curl’s TLS certification verification was disabled (CURLOPT_SSL_VERIFYPEER of false)

In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true.

Users are recommended to upgrade to 24.2.4 to avoid this flaw.

Thanks to OpenSource Security GmbH on behalf of the German Federal Office for Information Security for finding and reporting this issue.

Thanks to Thorsten Behrens of allotropia for providing a fix.

Curl SSL Certificate Verification

Addressed in LibreOffice 7.6.7/24.2.3

Announced: May 14, 2024

Fixed in: LibreOffice 7.6.7/24.2.3

LibreOffice supports binding scripts to click events on graphics. In affected version of LibreOffice there are scenarios where built-in scripts can be executed without warning if the user clicks on a document with such on-click handlers.

In early versions of LibreOffice these scripts were deemed trusted, but are now deemed untrusted.

In the fixed versions the user’s explicit macro execution permissions for the document, determined at load time, are used for these handlers.

Users are recommended to upgrade to 7.6.7 or 24.2.3 to avoid this flaw.

Thanks to Amel Bouziane-Leblond for finding and reporting this issue.

Thanks to Collabora Productivity for providing a fix.

Addressed in LibreOffice 7.6.4/7.5.9

Announced: December 11, 2023

Fixed in: LibreOffice 7.5.9/7.6.4

LibreOffice supports hyperlinks. In addition to the typical common protocols such as http/https hyperlinks can also have target URLs that can launch built-in macros or dispatch built-in internal commands. In affected version of LibreOffice there are scenarios where these can be executed without warning if the user activates such hyperlinks. In later versions the users’s explicit macro execution permissions for the document are now consulted if these non-typical hyperlinks can be executed. The possibility to use these variants of hyperlink targets for floating frames has been removed.

Users are recommended to upgrade to 7.5.9 or 7.6.4 to avoid this flaw.

Thanks to Reginaldo Silva of ubercomp.com for finding and reporting this issue.

Thanks to Collabora Productivity for providing a fix.

Addressed in LibreOffice 7.6.3/7.5.9

Announced: December 11, 2023

Fixed in: LibreOffice 7.5.9/7.6.3

LibreOffice supports embedded videos in file formats via platform audio/video support. Typically under Linux this is via gstreamer. In affected version of LibreOffice the filename of the embedded video is not sufficiently escaped when passed to gstreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system.

Linux Users are recommended to upgrade to 7.5.9 or 7.6.3 to avoid this flaw.

Thanks to Reginaldo Silva of ubercomp.com for finding and reporting this issue.

Thanks to Collabora Productivity for providing a fix.

Addressed in LibreOffice 7.4.7/7.5.3

Announced: May 24, 2023

Fixed in: LibreOffice 7.4.7/7.5.3

LibreOffice supports “Floating Frames”, similar to a html IFrame. The frames display their linked document in a floating frame inside the host document.

In affected versions of LibreOffice these floating frames fetch and display their linked document without prompt on loading the host document. This was inconsistent with the behavior of other linked document content such as OLE objects, Writer linked sections or Calc WEBSERVICE formulas which warn the user that there are linked documents and prompts if they should be allowed to update.

In versions >= 7.4.7 (and >= 7.5.3) the existing “update link” manager has been expanded to additionally control the update of the content of IFrames, so such IFrames will not automatically refresh their content unless the user agrees via the prompts.

Thanks to Amel Bouziane-Leblond for discovering this flaw.

Addressed in LibreOffice 7.4.6/7.5.1

Announced: May 24, 2023

Fixed in: LibreOffice 7.4.6/7.5.2

The Spreadsheet module of LibreOffice supports various formulas that take multiple parameters. The formulas are interpreted by ‘ScInterpreter’ which extract the required parameters for a given formula off a stack.

In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that the arbitrary code could be executed.

In versions >= 7.4.6 (and >= 7.5.2) the count of parameters is validated

Secusmart GmbH for discovering and reporting the issue.

Eike Rathke of Red Hat, Inc. for a solution.

Addressed in LibreOffice 7.3.6/7.4.1

Announced: October 11, 2022

Fixed in: LibreOffice 7.3.6/7.4.1

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme ‘vnd.libreoffice.command’ specific to LibreOffice was added.

In the affected versions of LibreOffice links using that scheme could be constructed to call internal macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary script execution without warning.

In versions >= 7.3.6 (and >= 7.4.1) such unwanted command URIs are blocked from execution.

TheSecurityDev working with Trend Micro Zero Day Initiative

Addressed in LibreOffice 7.2.7/7.3.3

Announced: July 25, 2022

Fixed in: LibreOffice 7.2.7/7.3.3

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user.

A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user’s configuration data.

In versions >= 7.2.7 (and >= 7.3.3) unique initialization vectors are used when the passwords are stored and the user is prompted via an infobar to reenter their master password in order to reencrypt old existing vulnerable stored config data if it exists.

OpenSource Security GmbH on behalf of the German Federal Office for Information Security.

Announced: July 25, 2022

Fixed in: LibreOffice 7.2.7/7.3.3

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user.

A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulnerable to a brute force attack if an attacker has access to the users stored config.

In versions >= 7.2.7 (and >= 7.3.3) the poor encoding is fixed and the user is prompted via an infobar to reenter their master password in order to reencrypt old existing vulnerable stored config data if it exists.

OpenSource Security GmbH on behalf of the German Federal Office for Information Security.

Addressed in LibreOffice 7.2.7/7.3.2

Announced: July 25, 2022

Fixed in: LibreOffice 7.2.7/7.3.2

LibreOffice supports the execution of macros. By default LibreOffice executes macros only if they are stored in a trusted file location or if they are signed by a trusted certificate.

To determine whether a macro is signed by a trusted author, LibreOffice matches the used certificate with the list of trusted certificates stored in the user’s configuration database.

An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate. An adversary could therefore create an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice would present as belonging to the trusted author, potentially leading to the user to execute arbitrary code contained in macros improperly trusted.

In versions >= 7.2.7 (and >= 7.3.2) certificate matching is amended to ensure the certificates match correctly.

This vulnerability is not exploitable if macro security level is set to very high or if the user has no trusted certificates.

OpenSource Security GmbH on behalf of the German Federal Office for Information Security.

Addressed in LibreOffice 7.2.6/7.3.1

Announced: March 24, 2023

Fixed in: LibreOffice 7.2.6/7.3.1

Most versions of LibreOffice support and contain components written in Java. LibreOffice extends the existing Java class path with its own internal classes.

In the affected versions of LibreOffice if the existing class path was empty, then when Java class files are loaded, the current working directory is searched for valid classes before using the embedded versions. If an attacker sends a zip file containing a class file alongside a document then, depending on the file manager or other tool used to open the zip file, when on navigating to the document and launching LibreOffice to open it, the current working directory of LibreOffice may be the directory in which the class file exists, in which case there is a risk that the arbitrary code of the class file could be executed.

In versions >= 7.2.6 (and >= 7.3.1) such unwanted empty paths are not appended to the classpath

European Commission’s Open Source Programme Office for sponsoring a security bug bounty for LibreOffice .

Stephan Bergmann of Red Hat, Inc. for a solution.

Addressed in LibreOffice 7.2.5/7.3.0

Announced: February 22, 2022

Fixed in: LibreOffice 7.2.5/7.3.0

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid.

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to contain both “X509Data” and “KeyValue” children of the “KeyInfo” tag[1], which when opened caused LibreOffice to verify using the “KeyValue” but to report verification with the unrelated “X509Data” value.

In versions >= 7.2.5 (and >= 7.3.0) certificate validation is configured to only consider X509Data children to limit validation to X509 certificates only.

[1]

Thanks to NDS of Ruhr University Bochum for discovering and reporting this problem.

Thanks to Aleksey Sanin for advice on a solution.

Addressed in LibreOffice 7.0.6/7.1.3

Announced: May 18, 2021

Fixed in: LibreOffice 7.0.6/7.1.3

LibreOffice has a feature where hyperlinks in a document can be activated by CTRL+click. Under macOS the link can be passed to the system ‘open’ utility for handling. LibreOffice contains a denylist of extensions that it blocks from passing to ‘open’ to avoid attempting to launch executables.

In versions of LibreOffice without this fix the denylist didn’t include the .fileloc extension which could be used to launch an executable on the system.

In the fixed versions this extension has been blocked. All macOS users are recommended to upgrade to LibreOffice >= 7.0.6 or 7.1.3

Thanks to Hou JingYi (@hjy79425575) of Qihoo 360 for discovering and reporting this problem

Addressed in LibreOffice 7.0.6/7.1.2

Announced: October 11, 2021

Fixed in: LibreOffice 7.0.6/7.1.2

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid.

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to combine multiple certificate data, which when opened caused LibreOffice to display a validly signed indicator but whose content was unrelated to the signature shown.

NDS of Ruhr University Bochum for discovering and reporting this problem.

Thanks to Michael Stahl of allotropia software GmbH for solving this problem.

Announced: October 11, 2021

Fixed in: LibreOffice 7.0.6/7.1.2

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid.

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time.

Thanks to NDS of Ruhr University Bochum for discovering and reporting this problem.

Thanks to Michael Stahl of allotropia software GmbH for solving this problem.

Addressed in LibreOffice 7.0.5/7.1.2

Announced: April 15, 2021

Fixed in: LibreOffice 7.0.5/7.1.2

LibreOffice has a feature where hyperlinks in a document can be activated by CTRL+click. Under Windows the link can be passed to the system ShellExecute function for handling. LibreOffice contains a denylist of extensions that it blocks from passing to ShellExecute to avoid attempting to launch executables.

In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn’t match the denylist but results in ShellExecute attempting to launch an executable type.

In the fixed versions this circumvention has been blocked. All Windows users are recommended to upgrade to LibreOffice >= 7.0.5 or >= 7.1.2

Thanks to Lukas Euler of Positive Security for discovering and reporting this problem

Addressed in LibreOffice 7.0.5/7.1.1

Announced: October 11, 2021

Fixed in: LibreOffice 7.0.5/7.1.1

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid.

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a valid signature issued by a trusted person.

Thanks to NDS of Ruhr University Bochum for discovering and reporting this problem.

Addressed in LibreOffice 6.4.4

Announced: Jun 08, 2020

LibreOffice has a ‘stealth mode’ in which only documents from locations deemed ’trusted’ are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice’s ability to include remote resources within a document. A flaw existed where remote graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4.

Thanks to Jens Müller of Ruhr University Bochum for discovering and reporting this problem

Announced: June 09, 2020

Fixed in: LibreOffice 6.4.4

ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need for macros or other active scripting

Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the form, but to avoid the possibility of malicious documents engineered to maximize the possibility of inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to overwrite local files.

All users are recommended to upgrade to LibreOffice >= 6.4.4

Thanks to Jens Müller of Ruhr University Bochum for discovering and reporting this problem

Addressed in LibreOffice 6.3.6/6.4.3

Announced: May 28, 2020

Fixed in: 6.3.6/6.4.3

If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the file format of the recovered document was not LibreOffice’s default ODF file format, then affected versions of LibreOffice default that subsequent saves of the document are unencrypted.

This may lead to a user accidentally saving a MSOffice file format document unencrypted while believing it to be encrypted.

In the fixed versions, encrypted recovered MSOffice format documents default to encrypted save.

Thanks to Tomas Florian [email protected] for raising awareness of the issue

Addressed in LibreOffice 6.2.7/6.3.1

Announced: September 6, 2019

Fixed in: 6.2.7/6.3.1

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc.

Access is intended to be restricted to scripts under the /Scripts/python, user/Scripts/python sub-directories of the LibreOffice install.

Protection was added, to address CVE-2019-9852, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed by employing a URL encoding attack to defeat the path verification step.

However this protection could be bypassed by taking advantage of a flaw in how LibreOffice assembled the final script URL location directly from components of the passed in path as opposed to solely from the sanitized output of the path verification step.

In the fixed versions, the parsed url describing the script location is assembled from the output of the verification step.

Thanks to RiceX(@ricex_cc) for reporting this issue

Announced: September 6, 2019

Fixed in: 6.2.7/6.3.1

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from.

LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc

Protection was added to block calling LibreLogo from script event handers. However a Windows 8.3 path equivalence handling flaw left LibreOffice vulnerable under Windows that a document could trigger executing LibreLogo via a Windows filename pseudonym

In the fixed versions, such paths are rejected

Thanks to alex (@insertscript) for reporting this issue

Addressed in LibreOffice 6.2.6/6.3.1

Announced: September 27, 2019

Fixed in: 6.2.6/6.3.1

LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default.

A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in the possibility to construct a document where macro execution bypassed the security settings.

The documents were correctly detected as containing macros, and prompted the user to their existence within the documents, but macros within the document were subsequently not controlled by the security settings allowing arbitrary macro execution

In the fixed versions, the parsed url describing the script location is correctly decoded before further processing.

Thanks to Nils Emmerich of ERNW Research GmbH for discovering and reporting this issue

Addressed in LibreOffice 6.2.6/6.3.0

Announced: August 15, 2019

Fixed in: 6.2.6/6.3.0

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from.

LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc

Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers.

In the fixed versions, script urls are correctly decoded before validation

Thanks to alex (@insertscript) for reporting this issue

Announced: August 15, 2019

Fixed in: 6.2.6/6.3.0

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from.

Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc

In the fixed versions, global script event handlers are validated equivalently to document script event handlers.

Thanks to Gabriel Masei of 1&1 for discovering and reporting this issue

Announced: August 15, 2019

Fixed in: 6.2.6/6.3.0

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc.

Access is intended to be restricted to scripts under the /Scripts/python, user/Scripts/python sub-directories of the LibreOffice install.

Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack.

In the fixed versions, the parsed url describing the script location is correctly encoded before further processing.

Thanks to Nils Emmerich of ERNW Research GmbH for discovering and reporting this issue

Addressed in LibreOffice 6.2.5

Announced: July 16, 2019

LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc.

LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands.

In the fixed versions, LibreLogo cannot be called from a document event handler..

Thanks to Nils Emmerich of ERNW Research GmbH for discovering and reporting this issue

Announced: July 16, 2019

LibreOffice has a ‘stealth mode’ in which only documents from locations deemed ’trusted’ are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice’s ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5.

Thanks to Matei “Mal” Badanoiu for discovering and reporting this problem

Addressed in LibreOffice 6.1.6/6.2.3

Announced: May 8, 2019

Fixed in: 6.1.6/6.2.3

Before 6.1.6/6.2.3 under Windows and macOS when processing a hyperlink target explicitly activated by the user there was no judgment made on whether the target was an executable file, so such executable targets were launched unconditionally.

In the fixed versions, such executables are not executed on hyperlink activation.

Thanks to Zhongcheng Li(CK01) of Pox Security Team for reporting this issue

Addressed in LibreOffice 6.0.7/6.1.3

Announced: Feb 1, 2019

Fixed in: 6.0.7/6.1.3

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various document events such as mouse-over, etc.

Prior to 6.0.7/6.1.3 LibreOffice was vulnerable to a directory traversal attack where it was possible to craft a document which when opened by LibreOffice would, when such common document events occur, execute a python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.

Typically LibreOffice is bundled with python, so an attacker has a set of known scripts at a known relative file system location to work with.

In the 6.1 series, the problem was compounded by an additional feature which enables specifying in the document arguments to pass to the python method (Earlier series only allow a method to be called with no argument). The bundled python happens to include a method which executes via os.system one of its arguments, providing a simple route in 6.1 to execute arbitrary commands via such a crafted document.

In the fixed versions, the relative directory flaw is fixed, and access is restricted to scripts under the /Scripts/python, user/Scripts/python sub-directories of the LibreOffice install

Thanks to alex (@insertscript) for reporting this issue

Addressed in LibreOffice 5.4.7/6.0.4

Announced: May 24, 2018

Addressed in: LibreOffice 5.4.7/6.0.4

A LibreOffice document with a linked image, which is on a samba , will cause LibreOffice to automatically initiate a samba connection to retrieve the image. This is analogous to how opening HTML documents which contain links to images on remote web sites are automatically fetched by web browsers.

Since LibreOffice 5.4.7, and 6.0.4 in the 6.X series, end users or administrators can disable this functionality to automatically fetch such linked images via “tools->options->security->options->block any links from documents not among the trusted locations”

Fixed in LibreOffice 5.4.6/6.0.2

Announced: April 18, 2018

Fixed in: LibreOffice 5.4.6/6.0.2

LibreOffice before 5.4.6 and 6.x before 6.0.2 have a flaw in an edge case in processing a specific uncommon Microsoft Word record. An index into a dynamically allocated buffer is used without bounds checking.

All users are recommended to upgrade to LibreOffice >= 5.4.6 or >= 6.0.2

Fixed in LibreOffice 5.4.5/6.0.1

Announced: February 9, 2018

Fixed in: LibreOffice 5.4.5/6.0.1

LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function.

LibreOffice Calc supports a WEBSERVICE function to obtain data by URL. Vulnerable versions of LibreOffice allow WEBSERVICE to take a local file URL (e.g file://) which can be used to inject local files into the spreadsheet without warning the user. Subsequent formulas can operate on that inserted data and construct a remote URL whose path leaks the local data to a remote attacker.

In later versions of LibreOffice without this flaw, WEBSERVICE has now been limited to accessing http and https URLs along with bringing WEBSERVICE URLs under LibreOffice Calc’s link management infrastructure.

All users are recommended to upgrade to LibreOffice >= 5.4.5 or >= 6.0.1

Announced: April 18, 2018

Fixed in: LibreOffice 5.4.5/6.0.1

LibreOffice before 5.4.5 and 6.x before 6.0.1 have a flaw in an edge case in processing the structured storage ole2 wrapper file format. A short datatype is used which can overflow resulting in a write to recently freed data

All users are recommended to upgrade to LibreOffice >= 5.4.5 or >= 6.0.1

Fixed in LibreOffice 5.2.5/5.3.0

Announced: April 21, 2017

Fixed in: LibreOffice 5.2.5/5.3.0

Windows Metafiles (WMF) can contain polygons which under certain circumstances when processed (split) can result in output polygons which have too many points to be represented by LibreOffice’s internal polygon class.

Prior to versions 5.2.5/5.3.0 this failure was undetected and a heap buffer overflo...