CVE-2025-64405CWE-862broken-access-control

CVE-2025-64405

High · published November 12, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
73.1
In the wild
Unconfirmed
What it is

⚡ A single crafted OpenOffice document can load external files without a peep from you! Imagine receiving an email where the spreadsheet quietly fetches sensitive info like a sneaky guest raiding your fridge without asking! This vulnerability is like a hotel guest who skips the check-in process and just strolls into your room, rifling through your belongings without your permission. The DDE links in the affected spreadsheets are the unwelcome guests, accessing files on your system without a second thought! An attacker could create a deceptive spreadsheet that pulls in external content without any warning, potentially exposing sensitive data or malicious files! This could lead to unauthorized access or even data leaks, putting your organization at substantial risk. It's a wake-up call for users who might think their files are safe!

Put simply

This vulnerability is like a hotel guest who skips the check-in process and just strolls into your room, rifling through your belongings without your permission. The DDE links in the affected spreadsheets are the unwelcome guests, accessing files on your system without a second thought! The flaw arises from a missing authorization check in Apache OpenOffice, allowing DDE links in Calc spreadsheets to fetch external files automatically, bypassing user prompts and checks.

What to do

An attacker could create a deceptive spreadsheet that pulls in external content without any warning, potentially exposing sensitive data or malicious files! This could lead to unauthorized access or even data leaks, putting your organization at substantial risk. It's a wake-up call for users who might think their files are safe! Upgrade to Apache OpenOffice version 4.1.16 immediately to patch this vulnerability. Review your document handling policies, and consider disabling DDE links if they're not essential for your workflow. 🌐 You've got this! Take these steps and you'll reinforce your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01446 · 73.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-11-12T14:15Z
Affected products (1)
ProductVersionsFixed in
apache/openoffice< 4.1.164.1.16
References (3)
EPSS history
Timeline
  • 12 NOV 09:10Z
    Apache OpenOffice: Remote documents loaded without prompt via DDE function
    cvelistv5