CVE-2025-64407
📋 TL;DR
Apache OpenOffice versions through 4.1.15 have an authorization vulnerability where specially crafted documents can automatically load external links without user permission. This allows attackers to exfiltrate system information like environment variables and configuration settings. All users of affected OpenOffice versions are vulnerable.
💻 Affected Systems
- Apache OpenOffice
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sensitive system configuration data, environment variables, and potentially credentials are exfiltrated to attacker-controlled servers, leading to further system compromise.
Likely Case
System information leakage including environment variables, configuration settings, and potentially user data is transmitted to external servers without user knowledge.
If Mitigated
With proper network segmentation and egress filtering, data exfiltration attempts are blocked, limiting impact to information disclosure within the local network.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious document). The vulnerability is similar to CVE-2024-12426 in LibreOffice.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.16
Vendor Advisory: https://www.openoffice.org/security/cves/CVE-2025-64407.html
Restart Required: No
Instructions:
1. Download Apache OpenOffice 4.1.16 from the official website. 2. Run the installer. 3. Follow installation prompts to upgrade. 4. Verify the new version is installed.
🔧 Temporary Workarounds
Disable automatic link loading
allConfigure OpenOffice to prompt before loading external links
Network egress filtering
allBlock outbound connections from OpenOffice to external servers
🧯 If You Can't Patch
- Use LibreOffice instead of Apache OpenOffice
- Implement strict document handling policies and only open documents from trusted sources
🔍 How to Verify
Check if Vulnerable:
Check OpenOffice version in Help → About Apache OpenOfficeCheck Version:
OpenOffice --version (Linux/macOS) or check Help → About (Windows)Verify Fix Applied:
Verify version is 4.1.16 or higher in Help → About Apache OpenOffice📡 Detection & Monitoring
Log Indicators:
- Unusual outbound network connections from OpenOffice process
- Multiple failed attempts to access external resources
Network Indicators:
- Outbound HTTP/HTTPS requests to unusual domains from OpenOffice
- Data exfiltration patterns from OpenOffice process
SIEM Query:
process_name:"soffice.bin" AND destination_ip:external AND (http_request OR https_request)