PT-2025-51211 · Document Foundation · Libreoffice

Karol Mazurek · Published 2025-12-15 · Updated 2025-12-15 · CVE-2025-14714

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 25.2.4

Description An authentication bypass issue existed due to the application bundling a Python interpreter that inherited Transparency, Consent, and Control (TCC) permissions granted to the main application. Executing the bundled interpreter allowed attacker scripts to run with the application’s TCC privileges. The fix involves using parent-constraints to restrict interpreter launches to only the main application with those permissions.

Recommendations Update to LibreOffice version 25.2.4 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

BDU:2026-02196

CVE-2025-14714

Affected Products

Libreoffice

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14714 · Security Note
• https://libreoffice.org/about-us/security/advisories/cve-2025-14714 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14714 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02196 · Security Note
• https://t.me/CVEtracker/39820 · Telegram Post
• https://twitter.com/CVEnew/status/2000611212909003197 · Twitter Post