PT-2025-9702 · Document Foundation+9 · Libreoffice+9

Amel Bouziane

+1

·

Published

2025-03-04

·

Updated

2025-06-01

·

CVE-2025-1080

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions LibreOffice versions 24.8 through 24.8.4 LibreOffice versions 25.2 through 25.2.0
Description The issue affects LibreOffice's integration with MS SharePoint server, where an additional scheme 'vnd.libreoffice.command' was added to support Office URI Schemes. In the affected versions, a link in a browser using this scheme could be constructed with an embedded inner URL that, when passed to LibreOffice, could call internal macros with arbitrary arguments. This allows attackers to execute arbitrary scripts, potentially leading to remote code execution attacks. The flaw bypasses existing security measures by targeting document collaboration workflows. Millions of users are at risk, particularly those relying on hybrid office solutions.
Recommendations For LibreOffice versions 24.8 through 24.8.4, update to version 24.8.5 or later. For LibreOffice versions 25.2 through 25.2.0, update to version 25.2.1 or later. As a temporary workaround, consider disabling the use of the 'vnd.libreoffice.command' scheme until a patch is available. Restrict access to internal macros to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

Related Identifiers

ALSA-2025:2868
ALT-PU-2025-3991
ALT-PU-2025-4604
BDU:2025-04329
CESA-2025_2868
CVE-2025-1080
DLA-4205-1
DSA-5873-1
INFSA-2025_2868
INFSA-2025_3408
MGASA-2025-0103
RHSA-2025:2868
RHSA-2025:3169
RHSA-2025:3265
RHSA-2025:3267
RHSA-2025:3269
RHSA-2025:3390
RHSA-2025:3408
RHSA-2025:3548
RHSA-2025:3549
RHSA-2025:3550
RHSA-2025_2868
RHSA-2025_3408
USN-7337-1

Affected Products

Alt Linux
Almalinux
Astra Linux
Centos
Debian
Libreoffice
Linuxmint
Red Hat
Rocky Linux
Ubuntu