CVE-2025-1080

CVE Details

Release Date:	2025-03-04
Impact:	Important	What is this?

Description

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.

See more information about CVE-2025-1080 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.6
Vector String:	CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H
Version:	3.1
Attack Vector:	Local
Attack Complexity:	High
Privileges Required:	None
User Interaction:	Required
Scope:	Changed
Confidentiality Impact:	Low
Integrity Impact:	High
Availability Impact:	High

Errata information

Platform

Errata

Release Date