CVE-2025-2866: Libreoffice

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.

Affected products

• Libreoffice Libreoffice: from 24.8.0.1, before 24.8.6.0 (fixed in 24.8.6.0); from 25.2.0.1, before 25.2.2 (fixed in 25.2.2); version 24.8.0.0 only; version 25.2.0.0 only

Published 2025-04-27. Last modified 2026-06-17.