CVE-2025-14714
📋 TL;DR
This CVE describes an authentication bypass vulnerability in LibreOffice on macOS where the bundled Python interpreter inherits the main application's TCC permissions. Attackers can execute scripts directly through the interpreter to bypass macOS privacy controls. This affects LibreOffice users on macOS versions 25.2 through 25.2.3.
💻 Affected Systems
- LibreOffice
📦 What is this software?
Libreoffice by Libreoffice
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to sensitive macOS-protected resources like camera, microphone, contacts, or files without user consent, potentially leading to data exfiltration or surveillance.
Likely Case
Local attackers with user-level access can bypass macOS privacy controls to access protected resources that LibreOffice has permission to use.
If Mitigated
With proper controls, only the main LibreOffice application can launch the interpreter with TCC permissions, preventing unauthorized script execution.
🎯 Exploit Status
Requires local access to the system and ability to execute scripts through the bundled Python interpreter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 25.2.4
Vendor Advisory: https://www.libreoffice.org/about-us/security/advisories/cve-2025-14714
Restart Required: Yes
Instructions:
1. Open LibreOffice. 2. Go to Help > Check for Updates. 3. Follow prompts to update to version 25.2.4 or later. 4. Restart LibreOffice after update completes.
🔧 Temporary Workarounds
Remove LibreOffice TCC permissions
macOSRevoke LibreOffice's TCC permissions in System Settings to prevent exploitation
1. Open System Settings > Privacy & Security
2. Select relevant categories (Camera, Microphone, Files, etc.)
3. Remove LibreOffice from allowed applications
Disable Python interpreter execution
macOSPrevent execution of the bundled Python interpreter
chmod -x /Applications/LibreOffice.app/Contents/Resources/python
🧯 If You Can't Patch
- Restrict user access to systems running vulnerable LibreOffice versions
- Monitor for unusual Python interpreter execution from LibreOffice directories
🔍 How to Verify
Check if Vulnerable:
Check LibreOffice version via About LibreOffice dialog or terminal commandCheck Version:
/Applications/LibreOffice.app/Contents/MacOS/soffice --versionVerify Fix Applied:
Confirm version is 25.2.4 or later and check that parent-constraints are properly implemented📡 Detection & Monitoring
Log Indicators:
- Python interpreter execution from LibreOffice directories without parent process being LibreOffice
- Unauthorized access attempts to TCC-protected resources
Network Indicators:
- Unusual outbound connections from LibreOffice Python processes
SIEM Query:
process.name:python AND process.path:/Applications/LibreOffice.app/* AND NOT parent.process.name:soffice