PT-2025-46560 · Apache · Apache Openoffice

Published 2025-11-11 · Updated 2025-11-12 · CVE-2025-64401

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions through 4.1.15

Description Apache OpenOffice had a missing authorization check that allowed an attacker to create a document that would load external links without user confirmation. Documents utilizing "floating frames" linked to external files would load the content of those frames without prompting the user for permission.

Recommendations Upgrade to version 4.1.16 to resolve this issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-15429

CVE-2025-64401

Affected Products

Apache Openoffice

References · 8

• https://openoffice.org/security/cves/CVE-2025-64401.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64401 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15429 · Security Note
• https://lists.apache.org/thread/o00dtgvhr9tx8r4y8vf6y2mg7nn6mx6c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64401 · Security Note
• https://twitter.com/oss_security/status/1988392609677816104 · Twitter Post
• https://t.me/cveNotify/142502 · Telegram Post
• https://twitter.com/CVEnew/status/1988543001833173108 · Twitter Post