CVE-2025-64403: Apache Openoffice

High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days.

Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause such links to be loaded without prompt. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue.

Affected products

• Apache Openoffice: before 4.1.16 (fixed in 4.1.16)

Published 2025-11-12. Last modified 2026-06-17.