End of life: 6/13/2027, Latest version: 26.8.0

LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.

Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters.

This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.

Last updated 21 May 2026

End of life: 11/30/2026, Latest version: 26.2.5

An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle

By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges

In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions

This issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.

Am 10.12.2025 um 12:35:17 Uhr schrieb Vincent Lefevre: Under Linux X11, LibreOffice (Writer, Calc, Draw...) silently puts searched text into the PRIMARY selection when a search is active and its window gets the focus. This can yield such text to be disclosed to web sites (when one clicks with the middle button in some form) and to other applications using the same X server (without needing any action from the user). This behavior exists in various applications like browsers, when focusing the address bar (I saw that in Pale Moon). Dunno if that is related to the GTK toolkit.

The common behavior for applications is that text is only copied to primary if it is actively selected.

-- Gruß Marco

Send unsolicited bulk mail to 1765366517muell () cartoonies org

Under Linux X11, LibreOffice (Writer, Calc, Draw...) silently puts searched text into the PRIMARY selection when a search is active and its window gets the focus. This can yield such text to be disclosed to web sites (when one clicks with the middle button in some form) and to other applications using the same X server (without needing any action from the user).

A search in LibreOffice should have remained local to LibreOffice. Text entered in the search field may be private or confidential, thus it must not be disclosed anywhere else.

To reproduce:

1. Start LibreOffice Writer (or Calc, Draw...). 2. Type Ctrl-F to start a search. 3. Type some text to search (a single character is sufficient). 4. Optional: Select some text in another application, e.g. xterm. 5. Move the cursor over the LibreOffice window. With window managers that support "focus-follows-mouse" (e.g. FVWM and twm), this window gets the focus. Otherwise you need to click so that this window gets the focus.

Result: The text in the LibreOffice search field automatically becomes the new PRIMARY selection. This can be seen by pasting the PRIMARY selection somewhere else (with the middle button) or with the following script (using the xclip utility):

while true do new=$(xclip -o 2> /dev/null) if [ "x$new" != "x$old" ]; then printf "%s\n" "$new" old=$new fi sleep 1 done

which prints text from the current PRIMARY selection, as soon as it is modified.

Note: The text in the LibreOffice search field appears as selected, but this should have remained internal to LibreOffice. For instance, when I click on the address bar of Firefox, its contents get selected, but the PRIMARY selection is unchanged.

Affected LibreOffice versions (at least): 24.2.5, 24.2.6 and 25.8.3.2

In case this matters, I'm using the libreoffice Debian package under Debian/unstable.

Bug I had reported last year (I forgot about it, until I got caught again today, wondering what was happening): https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1080978 https://bugs.documentfoundation.org/showbug.cgi?id=162821

-- Vincent Lefèvre <vincent () vinc17 net> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)

End of life: 6/12/2026, Latest version: 25.8.7

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a valid signature issued by a trusted person

This issue affects LibreOffice: from 7.0 before 7.0.5, from 7.1 before 7.1.1.

Last updated 11 March 2025

Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.This issue affects LibreOffice: from 24.8 before < 24.8.5.

Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice.

URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links.

This issue affects LibreOffice: from 24.8 before < 24.8.4.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal.

An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files.

This issue affects LibreOffice: from 24.8 before < 24.8.4.

Multiple heap-based buffer overflow flaws were found in the XML manifest encryption handling code of OpenOffice.org and LibreOffice:

1) Previously it was not checked if the particular tag was contained within expected parent tag, leading to possibility of child tag handler being able to write its data into different (than expected) parent handler sequence, leading to heap buffer overflow,

2) also a fixed size sequence was allocated to record properties of a particular XML tag, associated with XML element. By duplicating certain tags in XML manifest it was possible to write past the heap-based buffer bounds,

3) yet, the Base64 decoder implementation incorrectly assumed the length of ChecksumAttribute (input buffer) to be evenly divisible by 4, leading into the storage for output (Base64 decoded) buffer to be underallocated, resulting into heap buffer overflow.

A remote attacker could provide a specially-crafted Open Document Text (.odt) file, that when opened would cause OpenOffice.org / LibreOffice to crash or, potentially execute arbitrary code with the privileges of the user running a tool from the suite.