CVE-2025-2866
PDF signature forgery with adbe.pkcs7.sha1 SubFilter
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation.
In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid
This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PDF signature forgery with adbe.pkcs7.sha1 SubFilter
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation.
In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid
This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.
- Record
CVE-2025-2866- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2025-12434
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation.
In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid
This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.
- Record
EUVD-2025-12434- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-22mj-r7hq-f9h2
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF...
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation.
In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid
This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.
- Record
GHSA-22mj-r7hq-f9h2- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-02
NVD
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation.
In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid
This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.
- Record
CVE-2025-2866- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVBELL-CVE-2025-2866
- Record
BELL-CVE-2025-2866- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation.
In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid
This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.
- Record
CVE-2025-2866- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2025-2866
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.
- Record
DEBIAN-CVE-2025-2866- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-2866
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.
- Record
UBUNTU-CVE-2025-2866- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2025-0154 No score
Updated libreoffice packages fix security vulnerability
PDF signature forgery with adbe.pkcs7.sha1 SubFilter. (CVE-2025-2866)
- Record
MGASA-2025-0154- Updated
- 2026-11-02
OSVUSN-7504-1 No score
libreoffice vulnerability
Juraj Šarinay discovered that LibreOffice incorrectly handled verifying PDF signatures. A remote attacker could possibly use this issue to generate PDF files that appear to have a valid signature.
- Record
USN-7504-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libreoffice-headlessAlpaquita:stream |
24.8.4.2-r0 up to 25.2.2.2-r0 | 25.2.2.2-r0 |
libreofficeDebian:12 |
before 4:7.4.7-1+deb12u8, plus listed versions 4:7.4.5-34:7.4.7-14:7.4.7-1+deb12u14:7.4.7-1+deb12u1~bpo11+14:7.4.7-1+deb12u2 Show 7 moreShow less4:7.4.7-1+deb12u2~bpo11+14:7.4.7-1+deb12u34:7.4.7-1+deb12u44:7.4.7-1+deb12u54:7.4.7-1+deb12u64:7.4.7-1+deb12u74:7.4.7-1~bpo11+1 |
4:7.4.7-1+deb12u8 |
libreofficeDebian:13 |
before 4:25.2.2-1 | 4:25.2.2-1 |
libreofficeDebian:14 |
before 4:25.2.2-1 | 4:25.2.2-1 |
libreofficeDebian:11 From an advisory covering 2 CVEs |
before 1:7.0.4-4+deb11u13, plus listed versions 1:7.0.4-41:7.0.4-4+deb11u11:7.0.4-4+deb11u101:7.0.4-4+deb11u111:7.0.4-4+deb11u12 Show 11 moreShow less1:7.0.4-4+deb11u1~bpo10+11:7.0.4-4+deb11u21:7.0.4-4+deb11u31:7.0.4-4+deb11u3~bpo10+11:7.0.4-4+deb11u41:7.0.4-4+deb11u4~bpo10+11:7.0.4-4+deb11u51:7.0.4-4+deb11u61:7.0.4-4+deb11u71:7.0.4-4+deb11u81:7.0.4-4+deb11u9 |
1:7.0.4-4+deb11u13 |
libreofficeMageia:9 |
before 24.2.7.2-1.3.mga9 | 24.2.7.2-1.3.mga9 |
libreofficeUbuntu:20.04:LTS |
before 1:6.4.7-0ubuntu0.20.04.15, plus listed versions 1:6.3.2-0ubuntu21:6.3.3-0ubuntu11:6.3.3-0ubuntu21:6.3.4-0ubuntu11:6.4.0-0ubuntu4 Show 23 moreShow less1:6.4.0-0ubuntu61:6.4.0-0ubuntu71:6.4.1-0ubuntu11:6.4.2-0ubuntu11:6.4.2-0ubuntu21:6.4.2-0ubuntu31:6.4.3-0ubuntu0.20.04.11:6.4.4-0ubuntu0.20.04.11:6.4.5-0ubuntu0.20.04.11:6.4.6-0ubuntu0.20.04.11:6.4.7-0ubuntu0.20.04.11:6.4.7-0ubuntu0.20.04.21:6.4.7-0ubuntu0.20.04.41:6.4.7-0ubuntu0.20.04.51:6.4.7-0ubuntu0.20.04.61:6.4.7-0ubuntu0.20.04.71:6.4.7-0ubuntu0.20.04.81:6.4.7-0ubuntu0.20.04.91:6.4.7-0ubuntu0.20.04.101:6.4.7-0ubuntu0.20.04.111:6.4.7-0ubuntu0.20.04.121:6.4.7-0ubuntu0.20.04.131:6.4.7-0ubuntu0.20.04.14 |
1:6.4.7-0ubuntu0.20.04.15 |
libreofficeUbuntu:22.04:LTS |
before 1:7.3.7-0ubuntu0.22.04.10, plus listed versions 1:7.2.1-0ubuntu31:7.2.2-0ubuntu0.21.10.11:7.2.3~rc2-0ubuntu11:7.2.4-0ubuntu11:7.2.5~rc1-0ubuntu2 Show 21 moreShow less1:7.2.5~rc2-0ubuntu11:7.3.1~rc2-0ubuntu11:7.3.1~rc3-0ubuntu11:7.3.2~rc1-0ubuntu21:7.3.2~rc2-0ubuntu11:7.3.2-0ubuntu11:7.3.2-0ubuntu21:7.3.3-0ubuntu0.22.04.11:7.3.4-0ubuntu0.22.04.11:7.3.5-0ubuntu0.22.04.11:7.3.6-0ubuntu0.22.04.11:7.3.6-0ubuntu0.22.04.21:7.3.7-0ubuntu0.22.04.11:7.3.7-0ubuntu0.22.04.21:7.3.7-0ubuntu0.22.04.31:7.3.7-0ubuntu0.22.04.41:7.3.7-0ubuntu0.22.04.51:7.3.7-0ubuntu0.22.04.61:7.3.7-0ubuntu0.22.04.71:7.3.7-0ubuntu0.22.04.81:7.3.7-0ubuntu0.22.04.9 |
1:7.3.7-0ubuntu0.22.04.10 |
libreofficeUbuntu:24.04:LTS |
before 4:24.2.7-0ubuntu0.24.04.4, plus listed versions 4:7.6.2-0ubuntu14:7.6.3~rc1-0ubuntu24:7.6.3-0ubuntu34:7.6.4-0ubuntu14:7.6.4-0ubuntu3 Show 15 moreShow less4:24.2.0~rc1-0ubuntu14:24.2.1~rc1-0ubuntu14:24.2.1~rc2-0ubuntu14:24.2.2~rc2-0ubuntu14:24.2.2-0ubuntu14:24.2.3-0ubuntu0.24.04.14:24.2.3-0ubuntu0.24.04.24:24.2.4-0ubuntu0.24.04.14:24.2.4-0ubuntu0.24.04.24:24.2.5-0ubuntu0.24.04.14:24.2.5-0ubuntu0.24.04.24:24.2.6-0ubuntu0.24.04.14:24.2.7-0ubuntu0.24.04.14:24.2.7-0ubuntu0.24.04.24:24.2.7-0ubuntu0.24.04.3 |
4:24.2.7-0ubuntu0.24.04.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-2866 is a low vulnerability (CVSS 2.4) in Libreoffice, published April 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. Fixed in libreoffice-headless 25.2.2.2-r0.