PT-2025-46584 · Apache · Apache Openoffice

Published 2025-11-12 · Updated 2025-11-12 · CVE-2025-64405

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions through 4.1.15

Description Apache OpenOffice contains a missing authorization check when handling external links within documents. Specifically, Calc spreadsheets with Dynamic Data Exchange (DDE) links to external files could load the contents of those files without user confirmation. This could allow an attacker to craft a malicious document that, when opened, would execute code or access sensitive information from external sources without the user’s knowledge or consent.

Recommendations Upgrade to version 4.1.16 to resolve this issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-15434

CVE-2025-64405

Affected Products

Apache Openoffice

References · 9

• https://bdu.fstec.ru/vul/2025-15434 · Security Note
• https://openoffice.org/security/cves/CVE-2025-64405.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64405 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64405 · Vendor Advisory
• https://lists.apache.org/thread/0jjftxkcc4l9kt7jjn630hfrh2ygfcbk · Vendor Advisory
• https://t.me/cveNotify/142506 · Telegram Post
• https://t.me/cveNotify/142509 · Telegram Post
• http://openwall.com/lists/oss-security/2025/11/11/8 · Note
• https://twitter.com/CVEnew/status/1988542997747880312 · Twitter Post