CVE-2025-64401

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-12

Last updated on: 2025-11-13

Assigner: Apache Software Foundation

Description

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used "floating frames" linked to external files would load the contents of those frames without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue. The LibreOffice suite reported this issue as CVE-2023-2255

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-12

Last Modified

2025-11-13

Generated

2026-07-07

AI Q&A

2025-11-12

EPSS Evaluated

2026-07-06

NVD

CVE-2025-64401

EUVD

EUVD-2025-119983

Affected Vendors & Products

Vendor	Product	Version / Range
apache	openoffice	to 4.1.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache OpenOffice involves a missing authorization check that allows an attacker to create a document with "floating frames" linked to external files. When such a document is opened, the contents of these external links are loaded automatically without prompting the user for permission.

Impact Analysis

The vulnerability can impact you by causing your Apache OpenOffice to load external content without your consent, potentially exposing your system to malicious content or leaking information through automatic external requests.

Mitigation Strategies

Users are recommended to upgrade Apache OpenOffice to version 4.1.16, which fixes the issue.

Hi! I’m here to help you understand CVE-2025-64401. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70