Vulnerability Details : CVE-2025-1080
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments.
This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.
Products affected by CVE-2025-1080
Please log in to view affected product information.
Exploit prediction scoring system (EPSS) score for CVE-2025-1080
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 16 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2025-1080
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:L/V... |
N/A
|
N/A
|
Document Foundation, The | 2025-03-04 |
CWE ids for CVE-2025-1080
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: security@documentfoundation.org (Secondary)
References for CVE-2025-1080
-
https://www.libreoffice.org/about-us/security/advisories/cve-2025-1080
CVE-2025-1080 | LibreOffice - Free and private office suite - Based on OpenOffice - Compatible with Microsoft
Jump to