The Document Foundation vulnerabilities

Products

• Libreoffice 58

Newest

• the document foundation libreoffice Heap buffer overflow in dBASE index import CVE-2026-76181 Fix available 5.4 MediumNovember 5, 2026
• the document foundation libreoffice Environment/ini-file leaks CVE-2026-63270 Fix available 6.7 MediumOctober 5, 2026
• the document foundation libreoffice LFI and GET SSRF via GStreamer and HLS playlists CVE-2026-63269 Fix available 6.7 MediumOctober 5, 2026
• the document foundation libreoffice LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href CVE-2026-63268 Fix available 6.7 MediumOctober 5, 2026
• the document foundation libreoffice LFI and GET SSRF via calcext:data-mappings and csv provider CVE-2026-63267 Fix available 6.7 MediumOctober 5, 2026
• the document foundation libreoffice Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality CVE-2026-63266 Fix available 6.8 MediumOctober 5, 2026
• the document foundation libreoffice RCE via calcext:data-mappings, sql provider and jdbc connector CVE-2026-63277 Public exploitFix available 8.5 HighOctober 5, 2026
• the document foundation libreoffice Out of bounds read in PICT image import CVE-2026-63279 Fix available 5.4 MediumSeptember 22, 2026
• the document foundation libreoffice Package URLs can be used to exfiltrate arbitrary INI file values and environment variables CVE-2026-63278 Fix available 6.7 MediumSeptember 22, 2026
• the document foundation libreoffice Stack buffer overflow in CFF to Type 1 font conversion CVE-2026-63276 Fix available 5.4 MediumSeptember 22, 2026
• the document foundation libreoffice Stack buffer overflow in CFF font hint handling CVE-2026-63275 Fix available 5.4 MediumSeptember 22, 2026
• the document foundation libreoffice Heap buffer overflow in PDF import stream handling CVE-2026-63274 Fix available 5.4 MediumSeptember 22, 2026
• the document foundation libreoffice Heap buffer overflow in PDF import encryption handling CVE-2026-63273 Fix available 5.4 MediumSeptember 22, 2026
• the document foundation libreoffice Heap buffer overflow in WMF text record import CVE-2026-63272 Fix available 5.4 MediumSeptember 22, 2026
• the document foundation libreoffice Heap buffer overflow in spreadsheet tracked-changes import CVE-2026-8358 Fix available 5.4 MediumJune 15, 2026
• the document foundation libreoffice, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +11 more +13 more Heap buffer overflow in Calc formula compilation CVE-2026-8357 Fix available 5.4 MediumJune 15, 2026
• the document foundation libreoffice Stack buffer overflow in PPT presentation import CVE-2026-8356 Fix available 5.4 MediumJune 15, 2026
• the document foundation libreoffice Heap buffer overflow in OOXML text box element import CVE-2026-6047 Fix available 5.4 MediumJune 15, 2026
• the document foundation libreoffice Heap buffer overflow in EMF+ gradient brush import CVE-2026-6045 Fix available 5.4 MediumJune 15, 2026
• red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +2 more +4 more Heap use-after-free in ODF number-format blank-width parsing CVE-2026-6040 Fix available 5.4 MediumJune 15, 2026
• the document foundation libreoffice Heap buffer overflow in DXF polyline import CVE-2026-6039 Fix available 5.4 MediumJune 15, 2026
• libreoffice Heap Buffer Overflow in AgileEngine CVE-2026-4430 Fix available 5.4 MediumMay 7, 2026
• libreoffice TCC Bypass via Inherited Permissions in Bundled Interpreter CVE-2025-14714 0.9 LowDecember 15, 2025
• libreoffice PDF signature forgery with adbe.pkcs7.sha1 SubFilter CVE-2025-2866 Fix available 2.4 LowApril 27, 2025
• libreoffice, debian linux +1 more Macro URL arbitrary script execution CVE-2025-1080 Fix available 7.2 HighMarch 4, 2025
• libreoffice Executable hyperlink Windows path targets executed unconditionally on activation CVE-2025-0514 7.2 HighFebruary 25, 2025
• libreoffice, debian linux +1 more URL fetching can be used to exfiltrate arbitrary INI file values and environment variables CVE-2024-12426 Fix available 6.7 MediumJanuary 7, 2025
• libreoffice, debian linux +1 more Path traversal leading to arbitrary .ttf file write CVE-2024-12425 Fix available 2.4 LowJanuary 7, 2025
• libreoffice Signatures in "repair mode" should not be trusted CVE-2024-7788 Fix available 7.8 HighSeptember 17, 2024
• libreoffice Ability to trust not validated macro signatures removed in high security mode CVE-2024-6472 Fix available 7.8 HighAugust 5, 2024
• libreoffice TLS certificate are not properly verified when utilizing LibreOfficeKit CVE-2024-5261 Fix available 10.0 CriticalJune 25, 2024
• libreoffice, debian linux, fedoraproject fedora +2 more Graphic on-click binding allows unchecked script execution CVE-2024-3044 Fix available 6.5 MediumMay 14, 2024
• libreoffice, debian linux, fedoraproject fedora +2 more Link targets allow arbitrary script execution CVE-2023-6186 Fix available 8.3 HighDecember 11, 2023
• libreoffice, debian linux, fedoraproject fedora +2 more Improper input validation enabling arbitrary Gstreamer pipeline injection CVE-2023-6185 Fix available 8.3 HighDecember 11, 2023
• libreoffice, debian linux +1 more Remote documents loaded without prompt via IFrame CVE-2023-2255 Public exploitFix available 5.3 MediumMay 25, 2023
• libreoffice, debian linux +1 more Array Index UnderFlow in Calc Formula Parsing CVE-2023-0950 Fix available 7.8 HighMay 25, 2023
• libreoffice, debian linux, fedoraproject fedora +2 more Macro URL arbitrary script execution CVE-2022-3140 Fix available 6.3 MediumOctober 11, 2022
• libreoffice, debian linux +1 more Weak Master Keys CVE-2022-26307 Fix available 8.8 HighJuly 25, 2022
• libreoffice, debian linux +1 more Execution of Untrusted Macros Due to Improper Certificate Validation CVE-2022-26306 Fix available 7.5 HighJuly 25, 2022
• libreoffice Execution of Untrusted Macros Due to Improper Certificate Validation CVE-2022-26305 Fix available 7.5 HighJuly 25, 2022
• libreoffice, fedoraproject fedora +1 more Incorrect trust validation of signature with ambiguous KeyInfo children CVE-2021-25636 Fix available 7.5 HighFebruary 22, 2022
• libreoffice Content Manipulation with Certificate Validation Attack CVE-2021-25635 Fix available 5.2 MediumOctober 12, 2021
• libreoffice, debian linux +1 more Timestamp Manipulation with Signature Wrapping CVE-2021-25634 Fix available 7.5 HighOctober 12, 2021
• libreoffice, debian linux +1 more Content Manipulation with Double Certificate Attack CVE-2021-25633 Fix available 7.5 HighOctober 11, 2021
• libreoffice denylist of executable filename extensions possible to bypass under windows CVE-2021-25631 Fix available 8.8 HighMay 3, 2021
• collabora productivity online, the document foundation libreoffice online +1 more "loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolforkit" checks, if it was invoked by the "lool" user, and refu… CVE-2021-25630 7.8 HighFebruary 23, 2021
• libreoffice, fedoraproject fedora, opensuse leap +2 more XForms submissions could overwrite local files CVE-2020-12803 Fix available 6.5 MediumJune 8, 2020
• libreoffice, fedoraproject fedora, opensuse leap +2 more remote graphics contained in docx format retrieved in 'stealth mode' CVE-2020-12802 Fix available 5.3 MediumJune 8, 2020
• libreoffice, opensuse leap +1 more Crash-recovered MSOffice encrypted documents defaulted to not to using encryption on next save CVE-2020-12801 Fix available 5.3 MediumMay 18, 2020
• document foundation libreoffice, opensuse leap +1 more Windows 8.3 path equivalence handling flaw allows LibreLogo script execution CVE-2019-9855 Fix available 9.8 CriticalSeptember 6, 2019
• Show olderLoading…