CVE-2025-64401
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-12

Last updated on: 2025-11-13

Assigner: Apache Software Foundation

Description
Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used "floating frames" linked to external files would load the contents of those frames without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue. The LibreOffice suite reported this issue as CVE-2023-2255
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-12
Last Modified
2025-11-13
Generated
2026-06-16
AI Q&A
2025-11-12
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64401
EUVD
EUVD-2025-119983
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache openoffice to 4.1.16 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Apache OpenOffice involves a missing authorization check that allows an attacker to create a document with "floating frames" linked to external files. When such a document is opened, the contents of these external links are loaded automatically without prompting the user for permission.

Impact Analysis

The vulnerability can impact you by causing your Apache OpenOffice to load external content without your consent, potentially exposing your system to malicious content or leaking information through automatic external requests.

Mitigation Strategies

Users are recommended to upgrade Apache OpenOffice to version 4.1.16, which fixes the issue.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64401. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart