CVE-2024-12425
Path traversal leading to arbitrary .ttf file write
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal.
An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files.
This issue affects LibreOffice: from 24.8 before < 24.8.4.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Path traversal leading to arbitrary .ttf file write
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal.
An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files.
This issue affects LibreOffice: from 24.8 before < 24.8.4.
- Record
CVE-2024-12425- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2024-50846
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal.
An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files.
This issue affects LibreOffice: from 24.8 before < 24.8.4.
- Record
EUVD-2024-50846- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6x53-588x-53g2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in...
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal.
An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files.
This issue affects LibreOffice: from 24.8 before < 24.8.4.
- Record
GHSA-6x53-588x-53g2- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal.
An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files.
This issue affects LibreOffice: from 24.8 before < 24.8.4.
- Record
CVE-2024-12425- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal.
An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files.
This issue affects LibreOffice: from 24.8 before < 24.8.4.
- Record
CVE-2024-12425- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-12425
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4.
- Record
DEBIAN-CVE-2024-12425- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-12425
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4.
- Record
UBUNTU-CVE-2024-12425- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2025-0035 No score
Updated libreoffice packages fix security vulnerabilities
Path traversal leading to arbitrary .ttf file write. (CVE-2024-12425) URL fetching can be used to exfiltrate arbitrary INI file values and environment variables. (CVE-2024-12426)
- Record
MGASA-2025-0035- Updated
- 2026-11-02
OSVUSN-7228-1 No score
libreoffice vulnerabilities
Thomas Rinsma discovered that LibreOffice incorrectly handled paths when processing embedded font files. If a user or automated system were tricked into opening a specially crafted LibreOffice file, a remote attacker could possibly use this issue to create arbitrary files ending with ".ttf". (CVE-2024-12425)
Thomas Rinsma discovered that LibreOffice incorrectly handled certain environment variables and INI file values. If a user or automated system were tricked into opening a specially crafted LibreOffice file, a remote attacker could possibly use this issue to exfiltrate sensitive information. (CVE-2024-12426)
- Record
USN-7228-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libreofficeDebian:12 |
before 4:7.4.7-1+deb12u6, plus listed versions 4:7.4.5-34:7.4.7-14:7.4.7-1+deb12u14:7.4.7-1+deb12u1~bpo11+14:7.4.7-1+deb12u2 Show 5 moreShow less4:7.4.7-1+deb12u2~bpo11+14:7.4.7-1+deb12u34:7.4.7-1+deb12u44:7.4.7-1+deb12u54:7.4.7-1~bpo11+1 |
4:7.4.7-1+deb12u6 |
libreofficeDebian:13 |
before 4:24.8.4-1 | 4:24.8.4-1 |
libreofficeDebian:14 |
before 4:24.8.4-1 | 4:24.8.4-1 |
libreofficeDebian:11 From an advisory covering 2 CVEs |
before 1:7.0.4-4+deb11u12, plus listed versions 1:7.0.4-41:7.0.4-4+deb11u11:7.0.4-4+deb11u101:7.0.4-4+deb11u111:7.0.4-4+deb11u1~bpo10+1 Show 10 moreShow less1:7.0.4-4+deb11u21:7.0.4-4+deb11u31:7.0.4-4+deb11u3~bpo10+11:7.0.4-4+deb11u41:7.0.4-4+deb11u4~bpo10+11:7.0.4-4+deb11u51:7.0.4-4+deb11u61:7.0.4-4+deb11u71:7.0.4-4+deb11u81:7.0.4-4+deb11u9 |
1:7.0.4-4+deb11u12 |
libreofficeDebian:12 From an advisory covering 2 CVEs |
before 4:7.4.7-1+deb12u6, plus listed versions 4:7.4.5-34:7.4.7-14:7.4.7-1+deb12u14:7.4.7-1+deb12u1~bpo11+14:7.4.7-1+deb12u2 Show 5 moreShow less4:7.4.7-1+deb12u2~bpo11+14:7.4.7-1+deb12u34:7.4.7-1+deb12u44:7.4.7-1+deb12u54:7.4.7-1~bpo11+1 |
4:7.4.7-1+deb12u6 |
libreofficeMageia:9 From an advisory covering 2 CVEs |
before 24.2.7.2-1.mga9 | 24.2.7.2-1.mga9 |
libreofficeUbuntu:20.04:LTS |
before 1:6.4.7-0ubuntu0.20.04.13, plus listed versions 1:6.3.2-0ubuntu21:6.3.3-0ubuntu11:6.3.3-0ubuntu21:6.3.4-0ubuntu11:6.4.0-0ubuntu4 Show 21 moreShow less1:6.4.0-0ubuntu61:6.4.0-0ubuntu71:6.4.1-0ubuntu11:6.4.2-0ubuntu11:6.4.2-0ubuntu21:6.4.2-0ubuntu31:6.4.3-0ubuntu0.20.04.11:6.4.4-0ubuntu0.20.04.11:6.4.5-0ubuntu0.20.04.11:6.4.6-0ubuntu0.20.04.11:6.4.7-0ubuntu0.20.04.11:6.4.7-0ubuntu0.20.04.21:6.4.7-0ubuntu0.20.04.41:6.4.7-0ubuntu0.20.04.51:6.4.7-0ubuntu0.20.04.61:6.4.7-0ubuntu0.20.04.71:6.4.7-0ubuntu0.20.04.81:6.4.7-0ubuntu0.20.04.91:6.4.7-0ubuntu0.20.04.101:6.4.7-0ubuntu0.20.04.111:6.4.7-0ubuntu0.20.04.12 |
1:6.4.7-0ubuntu0.20.04.13 |
libreofficeUbuntu:22.04:LTS |
before 1:7.3.7-0ubuntu0.22.04.8, plus listed versions 1:7.2.1-0ubuntu31:7.2.2-0ubuntu0.21.10.11:7.2.3~rc2-0ubuntu11:7.2.4-0ubuntu11:7.2.5~rc1-0ubuntu2 Show 19 moreShow less1:7.2.5~rc2-0ubuntu11:7.3.1~rc2-0ubuntu11:7.3.1~rc3-0ubuntu11:7.3.2~rc1-0ubuntu21:7.3.2~rc2-0ubuntu11:7.3.2-0ubuntu11:7.3.2-0ubuntu21:7.3.3-0ubuntu0.22.04.11:7.3.4-0ubuntu0.22.04.11:7.3.5-0ubuntu0.22.04.11:7.3.6-0ubuntu0.22.04.11:7.3.6-0ubuntu0.22.04.21:7.3.7-0ubuntu0.22.04.11:7.3.7-0ubuntu0.22.04.21:7.3.7-0ubuntu0.22.04.31:7.3.7-0ubuntu0.22.04.41:7.3.7-0ubuntu0.22.04.51:7.3.7-0ubuntu0.22.04.61:7.3.7-0ubuntu0.22.04.7 |
1:7.3.7-0ubuntu0.22.04.8 |
libreofficeUbuntu:24.04:LTS |
before 4:24.2.7-0ubuntu0.24.04.2, plus listed versions 4:7.6.2-0ubuntu14:7.6.3~rc1-0ubuntu24:7.6.3-0ubuntu34:7.6.4-0ubuntu14:7.6.4-0ubuntu3 Show 13 moreShow less4:24.2.0~rc1-0ubuntu14:24.2.1~rc1-0ubuntu14:24.2.1~rc2-0ubuntu14:24.2.2~rc2-0ubuntu14:24.2.2-0ubuntu14:24.2.3-0ubuntu0.24.04.14:24.2.3-0ubuntu0.24.04.24:24.2.4-0ubuntu0.24.04.14:24.2.4-0ubuntu0.24.04.24:24.2.5-0ubuntu0.24.04.14:24.2.5-0ubuntu0.24.04.24:24.2.6-0ubuntu0.24.04.14:24.2.7-0ubuntu0.24.04.1 |
4:24.2.7-0ubuntu0.24.04.2 |
libreofficeUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 1:6.4.7-0ubuntu0.20.04.13, plus listed versions 1:6.3.2-0ubuntu21:6.3.3-0ubuntu11:6.3.3-0ubuntu21:6.3.4-0ubuntu11:6.4.0-0ubuntu4 Show 21 moreShow less1:6.4.0-0ubuntu61:6.4.0-0ubuntu71:6.4.1-0ubuntu11:6.4.2-0ubuntu11:6.4.2-0ubuntu21:6.4.2-0ubuntu31:6.4.3-0ubuntu0.20.04.11:6.4.4-0ubuntu0.20.04.11:6.4.5-0ubuntu0.20.04.11:6.4.6-0ubuntu0.20.04.11:6.4.7-0ubuntu0.20.04.11:6.4.7-0ubuntu0.20.04.21:6.4.7-0ubuntu0.20.04.41:6.4.7-0ubuntu0.20.04.51:6.4.7-0ubuntu0.20.04.61:6.4.7-0ubuntu0.20.04.71:6.4.7-0ubuntu0.20.04.81:6.4.7-0ubuntu0.20.04.91:6.4.7-0ubuntu0.20.04.101:6.4.7-0ubuntu0.20.04.111:6.4.7-0ubuntu0.20.04.12 |
1:6.4.7-0ubuntu0.20.04.13 |
libreofficeUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 1:7.3.7-0ubuntu0.22.04.8, plus listed versions 1:7.2.1-0ubuntu31:7.2.2-0ubuntu0.21.10.11:7.2.3~rc2-0ubuntu11:7.2.4-0ubuntu11:7.2.5~rc1-0ubuntu2 Show 19 moreShow less1:7.2.5~rc2-0ubuntu11:7.3.1~rc2-0ubuntu11:7.3.1~rc3-0ubuntu11:7.3.2~rc1-0ubuntu21:7.3.2~rc2-0ubuntu11:7.3.2-0ubuntu11:7.3.2-0ubuntu21:7.3.3-0ubuntu0.22.04.11:7.3.4-0ubuntu0.22.04.11:7.3.5-0ubuntu0.22.04.11:7.3.6-0ubuntu0.22.04.11:7.3.6-0ubuntu0.22.04.21:7.3.7-0ubuntu0.22.04.11:7.3.7-0ubuntu0.22.04.21:7.3.7-0ubuntu0.22.04.31:7.3.7-0ubuntu0.22.04.41:7.3.7-0ubuntu0.22.04.51:7.3.7-0ubuntu0.22.04.61:7.3.7-0ubuntu0.22.04.7 |
1:7.3.7-0ubuntu0.22.04.8 |
libreofficeUbuntu:24.04:LTS From an advisory covering 2 CVEs |
before 4:24.2.7-0ubuntu0.24.04.2, plus listed versions 4:7.6.2-0ubuntu14:7.6.3~rc1-0ubuntu24:7.6.3-0ubuntu34:7.6.4-0ubuntu14:7.6.4-0ubuntu3 Show 13 moreShow less4:24.2.0~rc1-0ubuntu14:24.2.1~rc1-0ubuntu14:24.2.1~rc2-0ubuntu14:24.2.2~rc2-0ubuntu14:24.2.2-0ubuntu14:24.2.3-0ubuntu0.24.04.14:24.2.3-0ubuntu0.24.04.24:24.2.4-0ubuntu0.24.04.14:24.2.4-0ubuntu0.24.04.24:24.2.5-0ubuntu0.24.04.14:24.2.5-0ubuntu0.24.04.24:24.2.6-0ubuntu0.24.04.14:24.2.7-0ubuntu0.24.04.1 |
4:24.2.7-0ubuntu0.24.04.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-12425 is a low vulnerability (CVSS 2.4) in Libreoffice, published January 7, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in libreoffice 4:7.4.7-1+deb12u6.
References
libreoffice.org/about-us/security/advisories/cve-2024-12425
lists.debian.org/debian-lts-announce/2025/01/msg00013.html
nvd.nist.gov/vuln/detail/CVE-2024-12425
github.com/advisories/GHSA-6x53-588x-53g2
security-tracker.debian.org/tracker/CVE-2024-12425
advisories.mageia.org/MGASA-2025-0035.html