CVE-2025-64405

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to external files would load the contents of those files without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/0jjftxkcc4l9kt7jjn630hfrh2ygfcbk	Mailing List Vendor Advisory
https://www.openoffice.org/security/cves/CVE-2025-64405.html	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/11/11/8	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Los documentos de Apache OpenOffice pueden contener enlaces. Una Vulnerabilidad de falta de autorización en Apache OpenOffice permitió a un atacante crear un documento que causaría que enlaces externos se cargaran sin aviso. En las versiones afectadas de Apache OpenOffice, las hojas de cálculo de Calc que contenían enlaces DDE a archivos externos cargarían el contenido de esos archivos sin solicitar al usuario permiso para hacerlo. Este problema afecta a Apache OpenOffice: hasta la versión 4.1.15. Se recomienda a los usuarios actualizar a la versión 4.1.16, que corrige el problema.

Information

Published : 2025-11-12 09:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64405

Mitre link : CVE-2025-64405

CVE.ORG link : CVE-2025-64405

JSON object : View

Products Affected

apache

openoffice

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-64405", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64405", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-13T16:40:34.344465Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache OpenOffice", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.1.15"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-12T09:15:41.643", "references": [{"url": "https://lists.apache.org/thread/0jjftxkcc4l9kt7jjn630hfrh2ygfcbk", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://www.openoffice.org/security/cves/CVE-2025-64405.html", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/11/11/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links \nto be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to external files would \nload the contents of those files without prompting the user for \npermission to do so.\n\nThis issue affects Apache OpenOffice: through 4.1.15.\n\nUsers are recommended to upgrade to version 4.1.16, which fixes the issue."}, {"lang": "es", "value": "Los documentos de Apache OpenOffice pueden contener enlaces. Una Vulnerabilidad de falta de autorizaci\u00f3n en Apache OpenOffice permiti\u00f3 a un atacante crear un documento que causar\u00eda que enlaces externos se cargaran sin aviso. En las versiones afectadas de Apache OpenOffice, las hojas de c\u00e1lculo de Calc que conten\u00edan enlaces DDE a archivos externos cargar\u00edan el contenido de esos archivos sin solicitar al usuario permiso para hacerlo.\n\nEste problema afecta a Apache OpenOffice: hasta la versi\u00f3n 4.1.15.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 4.1.16, que corrige el problema."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B08F777-BF20-4E1A-B3E1-42966B5AE2CF", "versionEndExcluding": "4.1.16"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}