PT-2025-46562 · Apache · Apache Openoffice

Thomas Rinsma · Published 2025-11-11 · Updated 2025-11-12 · CVE-2025-64407

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions through 4.1.15

Description Apache OpenOffice contains a missing authorization check when handling external links within documents. This allows an attacker to create a malicious document that loads external files without user confirmation. These links can be used to transmit sensitive system information, such as environment variables and configuration settings. The affected versions utilize a URI scheme that enables the inclusion of system configuration data, potentially exposing it externally.

Recommendations Upgrade to version 4.1.16 to resolve this issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-201

CWE-862

Related Identifiers

BDU:2025-15438

CVE-2025-64407

Affected Products

Apache Openoffice

References · 7

• https://openoffice.org/security/cves/CVE-2025-64407.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15438 · Security Note
• https://lists.apache.org/thread/4yg1gv71f14fw4ky4ds50o6xjq49594g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64407 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64407 · Vendor Advisory
• https://twitter.com/CVEnew/status/1988542995512385995 · Twitter Post
• https://twitter.com/oss_security/status/1988392609677816104 · Twitter Post