The Document Foundation LibreOffice
47 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-63270 | 26.2 – < < 26.2.5 | Environment/ini-file leaks | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-63269 | 26.2 – < < 26.2.5 | LFI and GET SSRF via GStreamer and HLS playlists | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-63268 | 26.2 – < < 26.2.5 | LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-63267 | 26.2 – < < 26.2.5 | LFI and GET SSRF via calcext:data-mappings and csv provider | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-63266 | 26.2 – < < 26.2.5 | Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-63277 | 26.2 – < < 26.2.5 | RCE via calcext:data-mappings, sql provider and jdbc connector | HIGH 8.5 | 0.3 % | ||
| CVE-2026-63279 | 26.2 – < < 26.2.5 | Out of bounds read in PICT image import | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-63278 | 26.2 – < < 26.2.5 | Package URLs can be used to exfiltrate arbitrary INI file values and environment variables | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-63276 | 26.2 – < < 26.2.5 | Stack buffer overflow in CFF to Type 1 font conversion | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-63275 | 26.2 – < < 26.2.5 | Stack buffer overflow in CFF font hint handling | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-63274 | 26.2 – < < 26.2.5 | Heap buffer overflow in PDF import stream handling | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-63273 | 26.2 – < < 26.2.5 | Heap buffer overflow in PDF import encryption handling | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-63272 | 26.2 – < < 26.2.5 | Heap buffer overflow in WMF text record import | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-8358 | 25.8 – < < 25.8.7 ; 26.2 – < < 26.2.4 | Heap buffer overflow in spreadsheet tracked-changes import | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-8357 | 26.2 – < < 26.2.4 | Heap buffer overflow in Calc formula compilation | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-8356 | 26.2 – < < 26.2.4 | Stack buffer overflow in PPT presentation import | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-6047 | 25.8 – < < 25.8.7 ; 26.2 – < < 26.2.3 | Heap buffer overflow in OOXML text box element import | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-6045 | 25.8 – < < 25.8.7 ; 26.2 – < < 26.2.3 | Heap buffer overflow in EMF+ gradient brush import | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-6040 | 25.8 – < < 25.8.7 ; 26.2 – < < 26.2.3 | Heap use-after-free in ODF number-format blank-width parsing | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-6039 | 25.8 – < < 25.8.7 ; 26.2 – < < 26.2.3 | Heap buffer overflow in DXF polyline import | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-4430 | 26.2 – < 26.2.3 ; 25.8 – < 25.8.7 | Heap Buffer Overflow in AgileEngine | MEDIUM 5.4 | 0.1 % | ||
| CVE-2025-14714 | 25.2 – < < 25.2.4 | TCC Bypass via Inherited Permissions in Bundled Interpreter | LOW 0.9 | 0.1 % | ||
| CVE-2025-2866 | 24.8 – < < 24.8.6 ; 25.2 – < < 25.2.2 | PDF signature forgery with adbe.pkcs7.sha1 SubFilter | LOW 2.4 | 0.1 % | ||
| CVE-2021-25635 | 7.0 – < 7.0.5 ; 7.1 – < 7.1.1 | Content Manipulation with Certificate Validation Attack | MEDIUM 5.2 | 0.1 % | ||
| CVE-2025-1080 | 24.8 – < < 24.8.5 ; 25.2 – < < 25.2.1 | Macro URL arbitrary script execution | HIGH 7.2 | 0.3 % | ||
| CVE-2025-0514 | 24.8 – < < 24.8.5 | Executable hyperlink Windows path targets executed unconditionally on activation | HIGH 7.2 | 0.3 % | ||
| CVE-2024-12426 | 24.8 – < < 24.8.4 | URL fetching can be used to exfiltrate arbitrary INI file values and environment variables | MEDIUM 6.7 | 0.5 % | ||
| CVE-2024-12425 | 24.8 – < < 24.8.4 | Path traversal leading to arbitrary .ttf file write | LOW 2.4 | 0.3 % | ||
| CVE-2024-7788 | 24.2 – < < 24.2.5 | Signatures in "repair mode" should not be trusted | HIGH 7.8 | 0.2 % | ||
| CVE-2024-6472 | 24.2 – < 24.2.5 | Ability to trust not validated macro signatures removed in high security mode | HIGH 7.8 | 0.2 % | ||
| CVE-2024-5261 | 24.2 – < 24.2.4 | TLS certificate are not properly verified when utilizing LibreOfficeKit | CRITICAL 10.0 | 0.4 % | ||
| CVE-2024-3044 | 7.6 – < 7.6.7 ; 24.2 – < 24.2.3 | Graphic on-click binding allows unchecked script execution | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-6186 | 7.5 – < 7.5.9 ; 7.6 – < 7.6.4 | Link targets allow arbitrary script execution | HIGH 8.8 | 0.8 % | ||
| CVE-2023-6185 | 7.5 – < 7.5.9 ; 7.6 – < 7.6.3 | Improper input validation enabling arbitrary Gstreamer pipeline injection | HIGH 8.8 | 1.0 % | ||
| CVE-2023-2255 | 7.4 – < 7.4.7 ; 7.5 – < 7.5.3 | Remote documents loaded without prompt via IFrame | MEDIUM 5.3 | 2.2 % | ||
| CVE-2023-0950 | 7.4 – < 7.4.6 ; 7.5 – < 7.5.1 | Array Index UnderFlow in Calc Formula Parsing | HIGH 7.8 | 0.3 % | ||
| CVE-2022-3140 | 7.4 – < 7.4.1 ; 7.3 – < 7.3.6 | Macro URL arbitrary script execution | MEDIUM 6.3 | 7.0 % | ||
| CVE-2022-26307 | 7.2 – < 7.2.7 ; 7.3 – < 7.3.3 | Weak Master Keys | HIGH 8.8 | 1.5 % | ||
| CVE-2022-26306 | 7.2 – < 7.2.7 ; 7.3 – < 7.3.1 | Execution of Untrusted Macros Due to Improper Certificate Validation | HIGH 7.5 | 1.1 % | ||
| CVE-2022-26305 | 7.2 – < 7.2.7 ; 7.3 – < 7.3.1 | Execution of Untrusted Macros Due to Improper Certificate Validation | HIGH 7.5 | 1.2 % | ||
| CVE-2021-25636 | 7.2 – < 7.2.5 | Incorrect trust validation of signature with ambiguous KeyInfo children | HIGH 7.5 | 1.0 % | ||
| CVE-2021-25634 | 7-0 – < 7.0.6 ; 7-1 – < 7.1.2 | Timestamp Manipulation with Signature Wrapping | HIGH 7.5 | 0.7 % | ||
| CVE-2021-25633 | 7-0 – < 7.0.6 ; 7-1 – < 7.1.2 | Content Manipulation with Double Certificate Attack | HIGH 7.5 | 0.7 % | ||
| CVE-2021-25631 | 7.1 – < 7.1.2 ; 7.0 – < 7.0.5 | denylist of executable filename extensions possible to bypass under windows | HIGH 8.8 | 5.0 % | ||
| CVE-2020-12803 | unspecified – < 6.4.4 | XForms submissions could overwrite local files | MEDIUM 6.5 | 1.8 % | ||
| CVE-2020-12802 | unspecified – < 6.4.4 | remote graphics contained in docx format retrieved in 'stealth mode' | MEDIUM 5.3 | 2.0 % | ||
| CVE-2020-12801 | 6-3 series – < 6.3.6 ; 6-4 series – < 6.4.3 | Crash-recovered MSOffice encrypted documents defaulted to not to using encryption on next save | MEDIUM 5.3 | 1.3 % |