Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 71

Export CSV
CVE-2026-4430

Heap Buffer Overflow in AgileEngine

Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Libreoffice The Document Foundation
Products
Libreoffice Libreoffice
CVE-2025-14714

TCC Bypass via Inherited Permissions in Bundled Interpreter

An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions This issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.

CVSS 4.0 · 0.9 Low EPSS < 1% KEV · Not listed
Vendors
Apple Libreoffice The Document Foundation
Products
Macos Libreoffice Libreoffice
CVE-2024-5261

TLS certificate are not properly verified when utilizing LibreOfficeKit

Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents. LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers. In affected versions of LibreOffice, when used in LibreOfficeKit mode only, then curl's TLS certification verification was disabled (CURLOPT_SSL_VERIFYPEER of false) In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true. This issue affects LibreOffice before version 24.2.4.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Libreoffice The Document Foundation
Products
Libreoffice Libreoffice
CVE-2024-6472

Ability to trust not validated macro signatures removed in high security mode

Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document with a signed macro is opened a warning is displayed by LibreOffice before the macro is executed. Previously if verification failed the user could fail to understand the failure and choose to enable the macros anyway. This issue affects LibreOffice: from 24.2 before 24.2.5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Libreoffice Redhat The Document Foundation
Products
Libreoffice Enterprise Linux Rhel Aus and 4 more
CVE-2025-0514

Executable hyperlink Windows path targets executed unconditionally on activation

Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.This issue affects LibreOffice: from 24.8 before < 24.8.5.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Libreoffice The Document Foundation
Products
Libreoffice Libreoffice
CVE-2021-25635

Content Manipulation with Certificate Validation Attack

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a valid signature issued by a trusted person This issue affects LibreOffice: from 7.0 before 7.0.5, from 7.1 before 7.1.1.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Libreoffice Redhat
Products
Libreoffice Enterprise Linux
CVE-2024-3044

Graphic on-click binding allows unchecked script execution

Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Debian Fedoraproject Libreoffice and 1 more
Products
Debian Linux Fedora Libreoffice and 1 more
CVE-2025-1080

Macro URL arbitrary script execution

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Debian Libreoffice Redhat
Products
Debian Linux Libreoffice Enterprise Linux and 5 more
CVE-2024-12425

Path traversal leading to arbitrary .ttf file write

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Debian Libreoffice The Document Foundation
Products
Debian Linux Libreoffice Libreoffice
CVE-2024-12426

URL fetching can be used to exfiltrate arbitrary INI file values and environment variables

Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. This issue affects LibreOffice: from 24.8 before < 24.8.4.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Libreoffice The Document Foundation
Products
Debian Linux Libreoffice Libreoffice
CVE-2025-2866

PDF signature forgery with adbe.pkcs7.sha1 SubFilter

Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Libreoffice
Products
Libreoffice
CVE-2023-0950

Array Index UnderFlow in Calc Formula Parsing

Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary code could be executed. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to 7.5.1.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Libreoffice Redhat
Products
Debian Linux Libreoffice Enterprise Linux
CVE-2017-7882

libreoffice: Heap-buffer-overflow in HWPFile::TagsRead

LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.

CVSS 3.0 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Libreoffice
Products
Libreoffice
CVE-2017-8358

libreoffice: heap-based buffer overflow related to the ReadJPEG function

LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.

CVSS 3.0 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Libreoffice
Products
Libreoffice
CVE-2017-7870

libreoffice: Heap-buffer-overflow in tools::Polygon::Insert

LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.

CVSS 3.0 · 9.8 Critical EPSS 3.9% KEV · Not listed
Vendors
Libreoffice Redhat
Products
Libreoffice Enterprise Linux
CVE-2017-14226

libwpd: Heap-based buffer over-read in WPXTableList class

WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Libreoffice Libwpd
Products
Libreoffice Libwpd
CVE-2017-7856

libreoffice: Heap-buffer-overflow in SVMConverter::ImplConvertFromSVM1

LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function in vcl/source/gdi/svmconverter.cxx.

CVSS 3.0 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Libreoffice
Products
Libreoffice
CVE-2016-10327

libreoffice: Heap-buffer-overflow in EnhWMFReader::ReadEnhWMF

LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx.

CVSS 3.0 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Libreoffice
Products
Libreoffice
CVE-2015-4551

libreoffice: Arbitrary file disclosure in Calc and Writer

LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow remote attackers to obtain sensitive information via a crafted document, which embeds data from local files into (1) Calc or (2) Writer.

CVSS 2.0 · 4.3 Medium EPSS 13.8% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Openoffice Ubuntu Linux Debian Linux and 2 more
CVE-2015-1774

libreoffice: HWP file filter vulnerability

The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.

CVSS 2.0 · 6.8 Medium EPSS 7.6% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Openoffice Ubuntu Linux Debian Linux and 6 more