Libreoffice Libreoffice
71 CVEs affecting Libreoffice Libreoffice. Latest disclosed: 2026-05-07. Critical: 12, High: 27.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5261 | Critical | 9.8 | 2024-06-25 | Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for acce… |
CVE-2019-9855 | Critical | 9.8 | 2019-09-06 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the d… |
CVE-2019-9851 | Critical | 9.8 | 2019-08-15 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the d… |
CVE-2019-9850 | Critical | 9.8 | 2019-08-15 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the d… |
CVE-2019-9848 | Critical | 9.8 | 2019-07-17 | LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffic… |
CVE-2018-14939 | Critical | 9.8 | 2018-08-05 | The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD l… |
CVE-2018-6871 | Critical | 9.8 | 2018-02-09 | LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT… |
CVE-2017-8358 | Critical | 9.8 | 2017-04-30 | LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpeg… |
CVE-2017-7882 | Critical | 9.8 | 2017-04-15 | LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx. |
CVE-2017-7870 | Critical | 9.8 | 2017-04-14 | LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/… |
CVE-2017-7856 | Critical | 9.8 | 2017-04-14 | LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function in vcl/source… |
CVE-2016-10327 | Critical | 9.8 | 2017-04-14 | LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/… |
CVE-2022-26307 | High | 8.8 | 2022-07-25 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master… |
CVE-2021-25631 | High | 8.8 | 2021-05-03 | In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating th… |
CVE-2023-6186 | High | 8.3 | 2023-12-11 | Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected ver… |
CVE-2023-6185 | High | 8.3 | 2023-12-11 | Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugi… |
CVE-2026-4430 | High | 7.8 | 2026-05-07 | Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue af… |
CVE-2025-1080 | High | 7.8 | 2025-03-04 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command'… |
CVE-2025-0514 | High | 7.8 | 2025-02-25 | Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on a… |
CVE-2024-7788 | High | 7.8 | 2024-09-17 | Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in Libr… |