https://vulnogram.org/ Most recent CVEs assigned by Document Foundation, The (document_fdn.). https://vulnogram.org/seaview/icons/document_fdn..png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-63270 https://vulnogram.org/CVE-2026-63270 URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cov… Medium Mon, 05 Oct 2026 11:17:24 GMT https://vulnogram.org/CVE-2026-63269 https://vulnogram.org/CVE-2026-63269 LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and t… Medium Mon, 05 Oct 2026 11:17:23 GMT https://vulnogram.org/CVE-2026-63268 https://vulnogram.org/CVE-2026-63268 LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet.… Medium Mon, 05 Oct 2026 11:17:22 GMT https://vulnogram.org/CVE-2026-63267 https://vulnogram.org/CVE-2026-63267 LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host… Medium Mon, 05 Oct 2026 11:17:22 GMT https://vulnogram.org/CVE-2026-63266 https://vulnogram.org/CVE-2026-63266 LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed vers… Medium Mon, 05 Oct 2026 11:17:21 GMT https://vulnogram.org/CVE-2026-63277 https://vulnogram.org/CVE-2026-63277 LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code fr… High Mon, 05 Oct 2026 11:17:20 GMT https://vulnogram.org/CVE-2026-63279 https://vulnogram.org/CVE-2026-63279 LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of en… Medium Tue, 22 Sep 2026 11:10:41 GMT https://vulnogram.org/CVE-2026-63278 https://vulnogram.org/CVE-2026-63278 URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not rec… Medium Tue, 22 Sep 2026 11:10:36 GMT https://vulnogram.org/CVE-2026-63276 https://vulnogram.org/CVE-2026-63276 LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written in… Medium Tue, 22 Sep 2026 11:10:32 GMT https://vulnogram.org/CVE-2026-63275 https://vulnogram.org/CVE-2026-63275 LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wr… Medium Tue, 22 Sep 2026 11:10:26 GMT https://vulnogram.org/CVE-2026-63274 https://vulnogram.org/CVE-2026-63274 LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying… Medium Tue, 22 Sep 2026 11:10:19 GMT https://vulnogram.org/CVE-2026-63273 https://vulnogram.org/CVE-2026-63273 LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer with… Medium Tue, 22 Sep 2026 11:10:13 GMT https://vulnogram.org/CVE-2026-63272 https://vulnogram.org/CVE-2026-63272 LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separ… Medium Tue, 22 Sep 2026 11:10:03 GMT https://vulnogram.org/CVE-2026-8358 https://vulnogram.org/CVE-2026-8358 LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, l… Medium Mon, 15 Jun 2026 16:24:03 GMT https://vulnogram.org/CVE-2026-8357 https://vulnogram.org/CVE-2026-8357 LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that wor… High Mon, 15 Jun 2026 16:23:37 GMT https://vulnogram.org/CVE-2026-8356 https://vulnogram.org/CVE-2026-8356 LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the… Medium Mon, 15 Jun 2026 16:23:06 GMT https://vulnogram.org/CVE-2026-6047 https://vulnogram.org/CVE-2026-6047 LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but i… Medium Mon, 15 Jun 2026 16:22:37 GMT https://vulnogram.org/CVE-2026-6045 https://vulnogram.org/CVE-2026-6045 LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but tha… Medium Mon, 15 Jun 2026 16:22:16 GMT https://vulnogram.org/CVE-2026-6040 https://vulnogram.org/CVE-2026-6040 A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed aga… High Mon, 15 Jun 2026 16:21:53 GMT https://vulnogram.org/CVE-2026-6039 https://vulnogram.org/CVE-2026-6039 LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full… Medium Mon, 15 Jun 2026 16:21:16 GMT https://vulnogram.org/CVE-2026-4430 https://vulnogram.org/CVE-2026-4430 Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7. Medium Thu, 07 May 2026 07:16:18 GMT https://vulnogram.org/CVE-2025-14714 https://vulnogram.org/CVE-2025-14714 An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle By executing the bundled in… Low Mon, 15 Dec 2025 10:30:55 GMT https://vulnogram.org/CVE-2025-2866 https://vulnogram.org/CVE-2025-2866 Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause inv… Low Sun, 27 Apr 2025 19:04:52 GMT https://vulnogram.org/CVE-2021-25635 https://vulnogram.org/CVE-2021-25635 An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) alg… Medium Fri, 21 Mar 2025 14:52:50 GMT https://vulnogram.org/CVE-2025-1080 https://vulnogram.org/CVE-2025-1080 LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a brow… High Tue, 04 Mar 2025 20:04:10 GMT https://vulnogram.org/CVE-2025-0514 https://vulnogram.org/CVE-2025-0514 Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.This issue affects LibreOffice: from 24.8 before < 24.8.5. High Tue, 25 Feb 2025 21:16:30 GMT https://vulnogram.org/CVE-2024-12426 https://vulnogram.org/CVE-2024-12426 Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensi… Medium Tue, 07 Jan 2025 12:22:32 GMT https://vulnogram.org/CVE-2024-12425 https://vulnogram.org/CVE-2024-12425 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplyin… Low Tue, 07 Jan 2025 11:15:08 GMT https://vulnogram.org/CVE-2024-7788 https://vulnogram.org/CVE-2024-7788 Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before < 24.2.5. High Tue, 17 Sep 2024 14:28:36 GMT https://vulnogram.org/CVE-2024-6472 https://vulnogram.org/CVE-2024-6472 Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document with a signed macro is opened a warning i… High Mon, 05 Aug 2024 12:55:39 GMT https://vulnogram.org/CVE-2024-5261 https://vulnogram.org/CVE-2024-5261 Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party compone… Critical Network Exploitable Tue, 25 Jun 2024 12:44:24 GMT https://vulnogram.org/CVE-2024-3044 https://vulnogram.org/CVE-2024-3044 Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deeme… Medium Network Exploitable Tue, 14 May 2024 20:19:51 GMT https://vulnogram.org/CVE-2023-6186 https://vulnogram.org/CVE-2023-6186 Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected versions LibreOffice supports hyperlinks with macro or similar built-in command targets that ca… High Mon, 11 Dec 2023 11:56:40 GMT https://vulnogram.org/CVE-2023-6185 https://vulnogram.org/CVE-2023-6185 Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped whe… High Mon, 11 Dec 2023 11:52:06 GMT https://vulnogram.org/CVE-2023-2255 https://vulnogram.org/CVE-2023-2255 Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floa… Thu, 25 May 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-0950 https://vulnogram.org/CVE-2023-0950 Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of… High Thu, 25 May 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-3140 https://vulnogram.org/CVE-2022-3140 LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice links using that… Tue, 11 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-26307 https://vulnogram.org/CVE-2022-26307 LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encode… Mon, 25 Jul 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-26306 https://vulnogram.org/CVE-2022-26306 LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization… Mon, 25 Jul 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-26305 https://vulnogram.org/CVE-2022-26305 An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certifica… Mon, 25 Jul 2022 00:00:00 GMT https://vulnogram.org/CVE-2021-25636 https://vulnogram.org/CVE-2021-25636 LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulner… Tue, 22 Feb 2022 00:00:00 GMT https://vulnogram.org/CVE-2021-25634 https://vulnogram.org/CVE-2021-25634 LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulner… Tue, 12 Oct 2021 13:33:54 GMT https://vulnogram.org/CVE-2021-25633 https://vulnogram.org/CVE-2021-25633 LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulner… Mon, 11 Oct 2021 16:43:34 GMT https://vulnogram.org/CVE-2021-25631 https://vulnogram.org/CVE-2021-25631 In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an… Mon, 03 May 2021 11:10:33 GMT https://vulnogram.org/CVE-2021-25630 https://vulnogram.org/CVE-2021-25630 "loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolforkit" checks, if it was invoked by the "lool" user, and refuses to run with privileges, if it's not the case.… Tue, 23 Feb 2021 15:33:49 GMT https://vulnogram.org/CVE-2020-12803 https://vulnogram.org/CVE-2020-12803 ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which… Mon, 08 Jun 2020 15:43:09 GMT https://vulnogram.org/CVE-2020-12802 https://vulnogram.org/CVE-2020-12802 LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include rem… Mon, 08 Jun 2020 15:23:05 GMT https://vulnogram.org/CVE-2020-12801 https://vulnogram.org/CVE-2020-12801 If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the file format… Mon, 18 May 2020 14:20:08 GMT https://vulnogram.org/CVE-2019-9853 https://vulnogram.org/CVE-2019-9853 LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the docume… Fri, 27 Sep 2019 15:07:40 GMT https://vulnogram.org/CVE-2019-9855 https://vulnogram.org/CVE-2019-9855 LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify tha… Fri, 06 Sep 2019 18:40:17 GMT