CVE-2025-64404
📋 TL;DR
Apache OpenOffice versions through 4.1.15 have a missing authorization vulnerability that allows attackers to craft documents that automatically load external files without user permission. This occurs when documents use background fill images or bullet images linked to external files. All users running affected versions are vulnerable.
💻 Affected Systems
- Apache OpenOffice
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could embed malicious content from external sources, potentially leading to remote code execution, data exfiltration, or system compromise when a user opens a crafted document.
Likely Case
Attackers could load malicious scripts or content from attacker-controlled servers, leading to information disclosure, phishing attacks, or malware delivery.
If Mitigated
With proper network segmentation and user awareness, the impact is limited to potential information disclosure from internal network resources.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious document. The vulnerability is straightforward to exploit once a malicious document is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.16
Vendor Advisory: https://www.openoffice.org/security/cves/CVE-2025-64404.html
Restart Required: Yes
Instructions:
1. Download Apache OpenOffice 4.1.16 from the official website
2. Close all OpenOffice applications
3. Run the installer to upgrade
4. Restart the system if prompted
🔧 Temporary Workarounds
Disable external content loading
allConfigure OpenOffice to block external content loading through security settings
Use alternative office suite
allTemporarily use LibreOffice or other office suites until patched
🧯 If You Can't Patch
- Implement strict document handling policies: only open documents from trusted sources
- Use network segmentation to restrict outbound connections from OpenOffice to untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check OpenOffice version in Help > About Apache OpenOfficeCheck Version:
OpenOffice --version (Linux) or check Help > About (Windows/macOS)Verify Fix Applied:
Verify version is 4.1.16 or higher in Help > About Apache OpenOffice📡 Detection & Monitoring
Log Indicators:
- Unusual outbound network connections from OpenOffice process
- Multiple failed attempts to load external resources
Network Indicators:
- HTTP/HTTPS requests to unusual domains from OpenOffice user agents
- Unexpected file downloads triggered by OpenOffice
SIEM Query:
process_name:"soffice.bin" AND (destination_ip:external_network OR url_contains:"http")