This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] LibreOffice fixes 2 vulnerabilities

LibreOffice fixes 2 vulnerabilities with versions 24.8.5 and 25.2.1 [1][2].

LibreOffice - improper input validation (CVE-2025-0514)
CVSS 6.5 (Medium)

Due to insufficient input validation, an unauthenticated local attacker can launch links pointing to Windows executable files without any restriction upon their activation [1].

The vulnerability is present in product:

  • *:LibreOffice; <24.8.5

CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H

More information:

The vulnerability was publicly disclosed 25. 2. 2025.

LibreOffice - arbitrary argument execution (CVE-2025-1080)
CVSS 7.6 (High)

An unauthenticated local attacker can create a link in a browser using the 'vnd.libreoffice.command' scheme that contains a nested URL. When this link is passed to LibreOffice, internal macros may be called with arbitrary arguments [2].

The vulnerability is present in product:

  • *:LibreOffice; <24.8.5

CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H

More information:

The vulnerability was publicly disclosed 4. 3. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 6. 3. 2025.

CESNET, z.s.p.o. Logo