This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-63273.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-63273.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-6045.

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL. XForms instance data and the Calc csv and sql data providers still reached the expansion. In fixed versions these places refuse URLs with internal schemes when the URL comes from the document.

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.

Last updated 5 October 2026

Last updated 5 October 2026

Last updated 5 October 2026

Last updated 5 October 2026

Last updated 5 October 2026

Last updated 5 October 2026

End of life: 6/13/2027, Latest version: 26.8.1

LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.

LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.

Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters.

This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.

Last updated 21 May 2026

End of life: 11/30/2026, Latest version: 26.2.5

An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle

By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges

In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions

This issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.

Am 10.12.2025 um 12:35:17 Uhr schrieb Vincent Lefevre: Under Linux X11, LibreOffice (Writer, Calc, Draw...) silently puts searched text into the PRIMARY selection when a search is active and its window gets the focus. This can yield such text to be disclosed to web sites (when one clicks with the middle button in some form) and to other applications using the same X server (without needing any action from the user). This behavior exists in various applications like browsers, when focusing the address bar (I saw that in Pale Moon). Dunno if that is related to the GTK toolkit.

The common behavior for applications is that text is only copied to primary if it is actively selected.

-- Gruß Marco

Send unsolicited bulk mail to 1765366517muell () cartoonies org

Under Linux X11, LibreOffice (Writer, Calc, Draw...) silently puts searched text into the PRIMARY selection when a search is active and its window gets the focus. This can yield such text to be disclosed to web sites (when one clicks with the middle button in some form) and to other applications using the same X server (without needing any action from the user).

A search in LibreOffice should have remained local to LibreOffice. Text entered in the search field may be private or confidential, thus it must not be disclosed anywhere else.

To reproduce:

1. Start LibreOffice Writer (or Calc, Draw...). 2. Type Ctrl-F to start a search. 3. Type some text to search (a single character is sufficient). 4. Optional: Select some text in another application, e.g. xterm. 5. Move the cursor over the LibreOffice window. With window managers that support "focus-follows-mouse" (e.g. FVWM and twm), this window gets the focus. Otherwise you need to click so that this window gets the focus.

Result: The text in the LibreOffice search field automatically becomes the new PRIMARY selection. This can be seen by pasting the PRIMARY selection somewhere else (with the middle button) or with the following script (using the xclip utility):

while true do new=$(xclip -o 2> /dev/null) if [ "x$new" != "x$old" ]; then printf "%s\n" "$new" old=$new fi sleep 1 done

which prints text from the current PRIMARY selection, as soon as it is modified.

Note: The text in the LibreOffice search field appears as selected, but this should have remained internal to LibreOffice. For instance, when I click on the address bar of Firefox, its contents get selected, but the PRIMARY selection is unchanged.

Affected LibreOffice versions (at least): 24.2.5, 24.2.6 and 25.8.3.2

In case this matters, I'm using the libreoffice Debian package under Debian/unstable.

Bug I had reported last year (I forgot about it, until I got caught again today, wondering what was happening): https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1080978 https://bugs.documentfoundation.org/showbug.cgi?id=162821

-- Vincent Lefèvre <vincent () vinc17 net> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)

End of life: 6/12/2026, Latest version: 25.8.7

Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation.

In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid

This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a valid signature issued by a trusted person

This issue affects LibreOffice: from 7.0 before 7.0.5, from 7.1 before 7.1.1.

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.

Last updated 11 March 2025

Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.This issue affects LibreOffice: from 24.8 before < 24.8.5.

Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice.

URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links.

This issue affects LibreOffice: from 24.8 before < 24.8.4.