CVE-2025-1080CWE-20

Macro URL arbitrary script execution

High · published March 4, 2025

CVSS v4.0
7.2
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments.

This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.

The record
Technical detail
CVSS v4.0
7.2 · HIGH
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:L/VA:H/SC:H/SI:H/SA:H
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-03-04T20:04Z
EPSS history
Timeline
  • 04 MAR 20:04Z
    Macro URL arbitrary script execution
    cvelistv5