LibreOffice Multi-Version Vulnerability Summary (CVE-2019 to CVE-2026)

Vulnerability Overview The webpage lists multiple security vulnerabilities, each with a corresponding CVE number and description. These vulnerabilities involve various security issues, including heap buffer overflows, path traversal, macro execution, certificate verification issues, and more. Affected Scope LibreOffice 26.2.3/25.8.7: Heap buffer overflow (CVE-2026-4430) LibreOffice 25.2.4/25.8.0: TCC bypass (CVE-2025-14714) LibreOffice 24.8.6/25.2.2: PDF signature forgery (CVE-2025-2866) LibreOffice 24.8.5/25.2.1: Arbitrary script execution via macro URL (CVE-2025-1080) LibreOffice 24.8.5: Unconditional execution of executable hyperlink Windows path target (CVE-2025-0514) LibreOffice 24.8.4: Path traversal leading to arbitrary .ttf file write (CVE-2024-12425), URL fetching can extract arbitrary INI file values and environment variables (CVE-2024-12426) LibreOffice 24.8.0/24.2.5: Signatures should not be trusted in "repair mode" (CVE-2024-7788) LibreOffice 24.2.5: Unverified macro signature trusted in high-security mode (CVE-2024-6472) LibreOffice 24.2.4: TLS certificate not properly verified when using LibreOfficeKit (CVE-2024-5261) LibreOffice 7.6.7/24.2.3: Graphic click binding allows unchecked script execution (CVE-2024-3044) LibreOffice 7.6.4/7.5.9: Link targets allow arbitrary script execution (CVE-2023-6186) LibreOffice 7.6.3/7.5.9: Improper input validation enables arbitrary Gstreamer pipeline injection (CVE-2023-6185) LibreOffice 7.4.7/7.5.3: Remote documents loaded via iframe silently (CVE-2023-2255) LibreOffice 7.4.6/7.5.1: Array index underflow in Calc formula parsing (CVE-2023-0950) LibreOffice 7.3.6/7.4.1: Arbitrary script execution via macro URL (CVE-2022-3140) LibreOffice 7.2.7/7.3.3: Static initialization vector allows recovery of Web connection passwords (CVE-2022-26306), weak master key (CVE-2022-26307) LibreOffice 7.2.7/7.3.2: Execution of untrusted macros due to improper certificate verification (CVE-2022-26305) LibreOffice 7.2.6/7.3.1: Empty entry in Java classpath may lead to arbitrary code execution (CVE-2022-38745) LibreOffice 7.2.5/7.3.0: Incorrect signature trust verification, ambiguous KeyInfo sub-elements (CVE-2021-25636) LibreOffice 7.0.6/7.1.3: fileloc extension added to macOS executable whitelist (CVE-2021-25632) LibreOffice 7.0.6/7.1.2: Content operations with double certificate attack (CVE-2021-25633), timestamp operations with signature wrapping (CVE-2021-25634) LibreOffice 7.0.5/7.1.2: Executable file name extension bypass on Windows (CVE-2021-25631) LibreOffice 7.0.5/7.1.1: Content operations with certificate verification attack (CVE-2021-25635) LibreOffice 6.4.4: Remote graphics retrieved in "stealth mode" in docx format (CVE-2020-12802), XForms submission may overwrite local files (CVE-2020-12803) LibreOffice 6.3.6/6.4.3: Crash recovery of MSOffice encrypted documents does not save encryption by default (CVE-2020-12801) LibreOffice 6.2.7/6.3.1: Insecure URL assembly in script location permission check (CVE-2019-9854), Windows 8.3 path equivalence handling vulnerability allows LibreLogo script execution (CVE-2019-9855) LibreOffice 6.2.6/6.3.1: URL decoding vulnerability in categorized macro locations (CVE-2019-9853) LibreOffice 6.2.6/6.3.0: Insufficient URL validation allows LibreLogo script execution (CVE-2019-9850), global event script execution (CVE-2019-9851), URL encoding vulnerability in script location permission check (CVE-2019-9852) LibreOffice 6.2.5: LibreLogo arbitrary script execution (CVE-2019-9848), remote bullet graphics retrieved in "stealth mode" (CVE-2019-9849) LibreOffice 6.1.6/6.2.3: Unconditional execution of executable hyperlink targets (CVE-2019-9847) LibreOffice 6.0.7/6.1.3: Directory traversal vulnerability in script execution (CVE-2018-16858) LibreOffice 5.4.7/6.0.4: Information leakage of ODF documents embedded via SMB links (CVE-2018-10583) LibreOffice 5.4.6/6.0.2: Heap buffer overflow in MSWord custom parsing (CVE-2018-10120) LibreOffice 5.4.5/6.0.1: Remote arbitrary file disclosure vulnerability via WEBSERVICE formula (CVE-2018-1055), Use After Free in structured storage parser (CVE-2018-10119) LibreOffice 5.2.5/5.3.0: Heap buffer overflow in WMF filter (CVE-2017-7870), heap buffer overflow in EMF filter (CVE-2016-10327) LibreOffice 5.1.6/5.2.2/5.3.0: Arbitrary file disclosure in Calc and Writer (CVE-2017-3157) LibreOffice 5.1.4/5.2.0: Dereferencing of invalid STL iterator in RTF file processing (CVE-2016-4324) LibreOffice 5.0.5/5.1.0: LotusWordPro buffer overflow in LwpFocSuperLayout processing (CVE-2016-0795) LibreOffice 5.0.4/5.1.0: LotusWordPro multiple buffer overflows in lwp filter (CVE-2016-0794) LibreOffice 5.0.2/5.1.0: Out-of-bounds write in Impress PPT filter (CVE-2017-12607), out-of-bounds write in Writer's ImportOldFormatStyles (CVE-2017-12608) LibreOffice 4.4.6/5.0.1: DOC bookmark state memory corruption (CVE-2015-5214) LibreOffice 4.4.5/5.0.0: Arbitrary file disclosure in Calc and Writer (CVE-2015-4551), ODF integer underflow (

Goal Reached Thanks to every supporter — we hit 100%!

LibreOffice Multi-Version Vulnerability Summary (CVE-2019 to CVE-2026)