CVE-2024-7788

Signatures in "repair mode" should not be trusted

7.8 HighFix available

Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before < 24.2.5.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.20%Up 0.2 points since Sep 18, 2024

What each source reports

CVE List Score used 7.8

Signatures in "repair mode" should not be trusted

Record: CVE-2024-7788
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-347
Updated: 2026-11-02

EUVDEUVD-2024-48649 7.8

Record: EUVD-2024-48649
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-62pp-53wf-pprq 7.8

Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document...

Record: GHSA-62pp-53wf-pprq
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-347
Updated: 2026-11-02

NVD 7.8

Record: CVE-2024-7788
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-347
Updated: 2026-11-02

OSVBELL-CVE-2024-7788 7.8

Record: BELL-CVE-2024-7788
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

Record: CVE-2024-7788
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-7788 7.8

Record: DEBIAN-CVE-2024-7788
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-7788 7.8

Record: UBUNTU-CVE-2024-7788
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-7025-1 No score

libreoffice vulnerability

It was discovered that LibreOffice would incorrectly handle digital signature verification after repairing a corrupted document. A remote attacker could possibly use this issue to forge valid signatures.

Record: USN-7025-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libreoffice-headless` Alpaquita:23	7.6.3.2-r3 and later	None known
`libreoffice-headless` Alpaquita:stream	7.6.4.1-r1 up to 24.8.4.2-r1	24.8.4.2-r1
`libreoffice` Debian:12	before 4:7.4.7-1+deb12u5, plus listed versions 4:7.4.5-34:7.4.7-14:7.4.7-1+deb12u14:7.4.7-1+deb12u1~bpo11+14:7.4.7-1+deb12u2 Show 4 moreShow less 4:7.4.7-1+deb12u2~bpo11+14:7.4.7-1+deb12u34:7.4.7-1+deb12u44:7.4.7-1~bpo11+1	4:7.4.7-1+deb12u5
`libreoffice` Debian:13	before 4:24.2.5-1	4:24.2.5-1
`libreoffice` Debian:14	before 4:24.2.5-1	4:24.2.5-1
`libreoffice` Debian:11	before 1:7.0.4-4+deb11u11, plus listed versions 1:7.0.4-41:7.0.4-4+deb11u11:7.0.4-4+deb11u101:7.0.4-4+deb11u1~bpo10+11:7.0.4-4+deb11u2 Show 9 moreShow less 1:7.0.4-4+deb11u31:7.0.4-4+deb11u3~bpo10+11:7.0.4-4+deb11u41:7.0.4-4+deb11u4~bpo10+11:7.0.4-4+deb11u51:7.0.4-4+deb11u61:7.0.4-4+deb11u71:7.0.4-4+deb11u81:7.0.4-4+deb11u9	1:7.0.4-4+deb11u11
`libreoffice` Ubuntu:20.04:LTS	before 1:6.4.7-0ubuntu0.20.04.12, plus listed versions 1:6.3.2-0ubuntu21:6.3.3-0ubuntu11:6.3.3-0ubuntu21:6.3.4-0ubuntu11:6.4.0-0ubuntu4 Show 20 moreShow less 1:6.4.0-0ubuntu61:6.4.0-0ubuntu71:6.4.1-0ubuntu11:6.4.2-0ubuntu11:6.4.2-0ubuntu21:6.4.2-0ubuntu31:6.4.3-0ubuntu0.20.04.11:6.4.4-0ubuntu0.20.04.11:6.4.5-0ubuntu0.20.04.11:6.4.6-0ubuntu0.20.04.11:6.4.7-0ubuntu0.20.04.11:6.4.7-0ubuntu0.20.04.21:6.4.7-0ubuntu0.20.04.41:6.4.7-0ubuntu0.20.04.51:6.4.7-0ubuntu0.20.04.61:6.4.7-0ubuntu0.20.04.71:6.4.7-0ubuntu0.20.04.81:6.4.7-0ubuntu0.20.04.91:6.4.7-0ubuntu0.20.04.101:6.4.7-0ubuntu0.20.04.11	1:6.4.7-0ubuntu0.20.04.12
`libreoffice` Ubuntu:22.04:LTS	before 1:7.3.7-0ubuntu0.22.04.7, plus listed versions 1:7.2.1-0ubuntu31:7.2.2-0ubuntu0.21.10.11:7.2.3~rc2-0ubuntu11:7.2.4-0ubuntu11:7.2.5~rc1-0ubuntu2 Show 18 moreShow less 1:7.2.5~rc2-0ubuntu11:7.3.1~rc2-0ubuntu11:7.3.1~rc3-0ubuntu11:7.3.2~rc1-0ubuntu21:7.3.2~rc2-0ubuntu11:7.3.2-0ubuntu11:7.3.2-0ubuntu21:7.3.3-0ubuntu0.22.04.11:7.3.4-0ubuntu0.22.04.11:7.3.5-0ubuntu0.22.04.11:7.3.6-0ubuntu0.22.04.11:7.3.6-0ubuntu0.22.04.21:7.3.7-0ubuntu0.22.04.11:7.3.7-0ubuntu0.22.04.21:7.3.7-0ubuntu0.22.04.31:7.3.7-0ubuntu0.22.04.41:7.3.7-0ubuntu0.22.04.51:7.3.7-0ubuntu0.22.04.6	1:7.3.7-0ubuntu0.22.04.7
`libreoffice` Ubuntu:24.04:LTS	before 4:24.2.5-0ubuntu0.24.04.2, plus listed versions 4:7.6.2-0ubuntu14:7.6.3~rc1-0ubuntu24:7.6.3-0ubuntu34:7.6.4-0ubuntu14:7.6.4-0ubuntu3 Show 10 moreShow less 4:24.2.0~rc1-0ubuntu14:24.2.1~rc1-0ubuntu14:24.2.1~rc2-0ubuntu14:24.2.2~rc2-0ubuntu14:24.2.2-0ubuntu14:24.2.3-0ubuntu0.24.04.14:24.2.3-0ubuntu0.24.04.24:24.2.4-0ubuntu0.24.04.14:24.2.4-0ubuntu0.24.04.24:24.2.5-0ubuntu0.24.04.1	4:24.2.5-0ubuntu0.24.04.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-7788 is a high vulnerability (CVSS 7.8) in Libreoffice, published September 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in libreoffice-headless 24.8.4.2-r1.