CVE-2025-64403
📋 TL;DR
Apache OpenOffice Calc has a missing authorization vulnerability that allows attackers to craft documents with external data source links that load without user prompts. This affects all Apache OpenOffice users through version 4.1.15, potentially enabling unauthorized file access or data exfiltration.
💻 Affected Systems
- Apache OpenOffice
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could load malicious files from external sources, potentially leading to remote code execution, data theft, or lateral movement within networks.
Likely Case
Unauthorized access to sensitive files or data exfiltration through crafted documents, potentially leading to information disclosure.
If Mitigated
With proper controls, the risk is limited to document processing within isolated environments, preventing external network access.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious document. No public exploit code has been disclosed as of the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.16
Vendor Advisory: https://www.openoffice.org/security/cves/CVE-2025-64403.html
Restart Required: Yes
Instructions:
1. Download Apache OpenOffice 4.1.16 from official website. 2. Close all OpenOffice applications. 3. Run installer and follow upgrade prompts. 4. Restart system to ensure complete update.
🔧 Temporary Workarounds
Disable external data sources
allConfigure OpenOffice to block or prompt for all external data source connections
Use alternative office suite
allTemporarily use LibreOffice or other office software until patched
🧯 If You Can't Patch
- Restrict document processing to isolated environments without internet access
- Implement strict email filtering for .ods files and user education about suspicious documents
🔍 How to Verify
Check if Vulnerable:
Check Help → About Apache OpenOffice and verify version is 4.1.15 or earlierCheck Version:
OpenOffice --version (Linux/macOS) or check About dialog (Windows)Verify Fix Applied:
Confirm version shows 4.1.16 or later in Help → About📡 Detection & Monitoring
Log Indicators:
- Unusual external file access attempts from OpenOffice processes
- Multiple failed authorization attempts
Network Indicators:
- Unexpected outbound connections from OpenOffice to external resources
SIEM Query:
process_name:"soffice.bin" AND (network_connection:* OR file_access:*)