CVE-2025-64404

Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used background fill images, or bullet images, linked to external files would load the contents of those files without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/08n4mdx0pnhqsllnkc63d27sdgq3tygc	Mailing List Vendor Advisory
https://www.openoffice.org/security/cves/CVE-2025-64404.html	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/11/11/7	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Los documentos de Apache OpenOffice pueden contener enlaces a otros archivos. Una Vulnerabilidad de falta de autorización en Apache OpenOffice permitió a un atacante crear un documento que causaría que los enlaces externos se cargaran sin aviso. En las versiones afectadas de Apache OpenOffice, los documentos que utilizaban imágenes de relleno de fondo, o imágenes de viñeta, vinculadas a archivos externos cargarían el contenido de esos archivos sin solicitar al usuario permiso para hacerlo. Este problema afecta a Apache OpenOffice: hasta la versión 4.1.15. Se recomienda a los usuarios actualizar a la versión 4.1.16, que corrige el problema.

Information

Published : 2025-11-12 09:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64404

Mitre link : CVE-2025-64404

CVE.ORG link : CVE-2025-64404

JSON object : View

Products Affected

apache

openoffice

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-64404", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64404", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-13T16:41:26.881531Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache OpenOffice", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.1.15"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-12T09:15:41.497", "references": [{"url": "https://lists.apache.org/thread/08n4mdx0pnhqsllnkc63d27sdgq3tygc", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://www.openoffice.org/security/cves/CVE-2025-64404.html", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/11/11/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links \nto be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used background fill images, or bullet images, linked to external files would \nload the contents of those files without prompting the user for \npermission to do so.\n\nThis issue affects Apache OpenOffice: through 4.1.15.\n\nUsers are recommended to upgrade to version 4.1.16, which fixes the issue."}, {"lang": "es", "value": "Los documentos de Apache OpenOffice pueden contener enlaces a otros archivos. Una Vulnerabilidad de falta de autorizaci\u00f3n en Apache OpenOffice permiti\u00f3 a un atacante crear un documento que causar\u00eda que los enlaces externos se cargaran sin aviso. En las versiones afectadas de Apache OpenOffice, los documentos que utilizaban im\u00e1genes de relleno de fondo, o im\u00e1genes de vi\u00f1eta, vinculadas a archivos externos cargar\u00edan el contenido de esos archivos sin solicitar al usuario permiso para hacerlo.\n\nEste problema afecta a Apache OpenOffice: hasta la versi\u00f3n 4.1.15.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 4.1.16, que corrige el problema."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B08F777-BF20-4E1A-B3E1-42966B5AE2CF", "versionEndExcluding": "4.1.16"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}