Product by The Document Foundation
Libreoffice
47 known vulnerabilities in Libreoffice (The Document Foundation), 0 of them actively exploited (CISA KEV).
Key figures
47
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2021-25631 | denylist of executable filename extensions possible to bypass under windows | 8.8 | |
| Medium | CVE-2022-3140 | Macro URL arbitrary script execution | 6.3 | |
| High | CVE-2022-26307 | Weak Master Keys | 8.8 | |
| Medium | CVE-2023-2255 | Remote documents loaded without prompt via IFrame | 5.3 | |
| Medium | CVE-2020-12803 | XForms submissions could overwrite local files | 6.5 | |
| High | CVE-2026-63277 | RCE via calcext:data-mappings, sql provider and jdbc connector | — | |
| Medium | CVE-2020-12802 | remote graphics contained in docx format retrieved in 'stealth mode' | 5.3 | |
| High | CVE-2023-6185 | Improper input validation enabling arbitrary Gstreamer pipeline injection | 8.3 | |
| High | CVE-2022-26305 | Execution of Untrusted Macros Due to Improper Certificate Validation | 7.5 | |
| High | CVE-2022-26306 | Execution of Untrusted Macros Due to Improper Certificate Validation | 7.5 | |
| High | CVE-2023-6186 | Link targets allow arbitrary script execution | 8.3 | |
| Medium | CVE-2024-3044 | Graphic on-click binding allows unchecked script execution | 6.5 | |
| High | CVE-2021-25636 | Incorrect trust validation of signature with ambiguous KeyInfo children | 7.5 | |
| High | CVE-2025-1080 | Macro URL arbitrary script execution | 7.8 | |
| Critical | CVE-2024-5261 | TLS certificate are not properly verified when utilizing LibreOfficeKit | 9.8 | |
| Medium | CVE-2020-12801 | Crash-recovered MSOffice encrypted documents defaulted to not to using encryption on next save | 5.3 | |
| Medium | CVE-2026-63266 | Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality | — | |
| Medium | CVE-2026-63268 | LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href | — | |
| Medium | CVE-2026-63270 | Environment/ini-file leaks | — | |
| Medium | CVE-2026-63269 | LFI and GET SSRF via GStreamer and HLS playlists | — | |
| Medium | CVE-2026-63267 | LFI and GET SSRF via calcext:data-mappings and csv provider | — | |
| High | CVE-2026-4430 | Heap Buffer Overflow in AgileEngine | 7.8 | |
| High | CVE-2021-25633 | Content Manipulation with Double Certificate Attack | 7.5 | |
| Medium | CVE-2026-63278 | Package URLs can be used to exfiltrate arbitrary INI file values and environment variables | — | |
| High | CVE-2021-25634 | Timestamp Manipulation with Signature Wrapping | 7.5 |