Nds Of

**Name of the Vulnerable Software and Affected Versions** LibreOffice versions 7.2 prior to 7.2.5 **Description** The issue is related to improper certificate validation in LibreOffice, allowing an attacker to create a digitally signed ODF document by manipulating the `documentsignatures.xml` or `macrosignatures.xml` stream within the document. This manipulation involves adding both `X509Data` and `KeyValue` children of the `KeyInfo` tag, causing LibreOffice to verify using the `KeyValue` but report verification with the unrelated `X509Data` value. This can enable an attacker to bypass security restrictions. **Recommendations** For LibreOffice versions 7.2 prior to 7.2.5, update to version 7.2.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of digital signatures in ODF documents until the update is applied. Avoid using the `X509Data` and `KeyValue` parameters in the `KeyInfo` tag of the `documentsignatures.xml` or `macrosignatures.xml` stream within the document to minimize the risk of exploitation.