CVE-2023-6186 – This vulnerability in LibreOffice allows attack... (How to Fix)

Q: What is the severity of CVE-2023-6186?

CVE-2023-6186 has a CVSS score of 8.3 (HIGH). This vulnerability in LibreOffice allows attackers to execute built-in macros without user warnings by exploiting insufficient permission validation in hyperlinks. Users who open malicious documents in affected LibreOffice versions are at risk of arbitrary code execution.

📋 TL;DR

This vulnerability in LibreOffice allows attackers to execute built-in macros without user warnings by exploiting insufficient permission validation in hyperlinks. Users who open malicious documents in affected LibreOffice versions are at risk of arbitrary code execution.

💻 Affected Systems

Products:

LibreOffice

Versions: Versions prior to 24.2.0

Operating Systems: Linux, Windows, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: All LibreOffice installations with default settings are vulnerable. The vulnerability affects the core document processing functionality.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise via arbitrary code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement within networks.

🟠

Likely Case

Malicious document execution leading to malware installation, credential harvesting, or data exfiltration from the victim's system.

🟢

If Mitigated

Limited impact if macros are disabled or documents are opened in sandboxed environments, though some functionality loss may occur.

🌐 Internet-Facing: MEDIUM - Requires user interaction (opening malicious document) but commonly exploited via phishing or malicious downloads.

🏢 Internal Only: MEDIUM - Internal phishing campaigns or shared malicious documents could exploit this vulnerability within organizations.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires user interaction (opening malicious document) but is straightforward once the document is opened. Proof-of-concept examples exist in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 24.2.0 and later

Vendor Advisory: https://www.libreoffice.org/about-us/security/advisories/cve-2023-6186

Restart Required: No

Instructions:

1. Update LibreOffice to version 24.2.0 or later. 2. On Linux: Use your distribution's package manager (apt update && apt upgrade libreoffice). 3. On Windows/macOS: Download latest version from libreoffice.org. 4. Verify update completed successfully.

🔧 Temporary Workarounds

Disable macro execution

all

Prevent macro execution entirely in LibreOffice settings

Not applicable - GUI configuration only

Use macro security settings

all

Set macro security to 'High' to require digital signatures

Not applicable - Configure via Tools > Options > Security > Macro Security

🧯 If You Can't Patch

Open documents in LibreOffice's read-only mode or use alternative document viewers
Implement application whitelisting to block LibreOffice execution entirely

🔍 How to Verify

Check if Vulnerable:

Check LibreOffice version: Help > About LibreOffice. If version is below 24.2.0, system is vulnerable.

Check Version:

libreoffice --version (Linux) or check Help > About (Windows/macOS)

Verify Fix Applied:

After updating, verify version is 24.2.0 or higher in Help > About LibreOffice. Test with known safe documents containing macros.

📡 Detection & Monitoring

Log Indicators:

Unexpected macro execution events
Documents with hyperlinks triggering macros
LibreOffice crash logs after document opening

Network Indicators:

Outbound connections initiated after opening documents
Downloads of additional payloads following document access

SIEM Query:

source="libreoffice" AND (event="macro_execution" OR event="hyperlink_activation")

📊 Metadata

CVE ID: CVE-2023-6186

CVSS v3 Score: 8.3 (HIGH)

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H

CWE: CWE-281

Published: December 11, 2023

Last Updated: February 13, 2025

🔗 References

https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB7UB6CTWQUDOE657OVVRSDYUY3IPBJG/ Mailing List,Third Party Advisory
https://www.debian.org/security/2023/dsa-5574 Third Party Advisory
https://www.libreoffice.org/about-us/security/advisories/cve-2023-6186 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB7UB6CTWQUDOE657OVVRSDYUY3IPBJG/ Mailing List,Third Party Advisory
https://www.debian.org/security/2023/dsa-5574 Third Party Advisory
https://www.libreoffice.org/about-us/security/advisories/cve-2023-6186 Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-6186, you might also want to check these: