CVE-2025-64405
📋 TL;DR
Apache OpenOffice versions through 4.1.15 have a missing authorization vulnerability where specially crafted Calc spreadsheets containing DDE links can automatically load external files without user consent. This allows attackers to potentially access sensitive data from the victim's system. All users running affected OpenOffice versions are vulnerable.
💻 Affected Systems
- Apache OpenOffice
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could exfiltrate sensitive local files (including credentials, documents, configuration files) from the victim's system by embedding malicious DDE links in a spreadsheet.
Likely Case
Targeted attacks where victims open malicious spreadsheets could lead to unauthorized file access and data leakage.
If Mitigated
With proper user awareness and file validation, the risk is limited to accidental exposure of non-critical files.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious document). No authentication bypass needed beyond the missing authorization for DDE links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.16
Vendor Advisory: https://www.openoffice.org/security/cves/CVE-2025-64405.html
Restart Required: Yes
Instructions:
1. Download Apache OpenOffice 4.1.16 from official website. 2. Close all OpenOffice applications. 3. Run installer and follow prompts. 4. Restart computer if prompted.
🔧 Temporary Workarounds
Disable DDE links
allConfigure OpenOffice to disable DDE link processing
Not applicable - requires GUI configuration in Tools > Options > Security
Use LibreOffice
allSwitch to LibreOffice which is not affected by this vulnerability
sudo apt install libreoffice (Linux)
Download from https://www.libreoffice.org/ (Windows/macOS)
🧯 If You Can't Patch
- Educate users to never open untrusted OpenOffice documents, especially .ods files
- Implement application whitelisting to block execution of older OpenOffice versions
🔍 How to Verify
Check if Vulnerable:
Check OpenOffice version via Help > About Apache OpenOffice. If version is 4.1.15 or earlier, you are vulnerable.Check Version:
OpenOffice --version (Linux/macOS) or check via Help menu (all platforms)Verify Fix Applied:
After upgrading, verify version shows 4.1.16 or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from OpenOffice process
- Multiple DDE connection attempts in system logs
Network Indicators:
- Unexpected outbound connections from OpenOffice to external resources
SIEM Query:
process_name:"soffice.bin" AND (file_access:* OR network_connection:*)