Apache Openoffice vulnerabilities

60 CVEs affecting Apache Openoffice, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-64407, published 2025-11-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-10583, published 2018-05-01. High severity, CVSS 7.5. EPSS: 78% chance of exploitation in the next 30 days. An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as…
CVE-2021-33035, published 2021-09-23. High severity, CVSS 7.8. EPSS: 50.6% chance of exploitation in the next 30 days. Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not…
CVE-2014-3524, published 2014-08-26. High severity, CVSS 9.3. EPSS: 14.5% chance of exploitation in the next 30 days. Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.
CVE-2009-2949, published 2010-02-16. High severity, CVSS 9.3. EPSS: 14.2% chance of exploitation in the next 30 days. Integer overflow in the XPMReader::ReadXPM function in filter.vcl/ixpm/svt_xpmread.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to execute arbitrary code via a crafted XPM file that…
CVE-2015-4551, published 2015-11-10. Medium severity, CVSS 4.3. EPSS: 13.8% chance of exploitation in the next 30 days. LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow…
CVE-2012-0037, published 2012-06-17. Medium severity, CVSS 6.5. EPSS: 13.7% chance of exploitation in the next 30 days. Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read…
CVE-2009-2950, published 2010-02-16. High severity, CVSS 9.3. EPSS: 13.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in the GIFLZWDecompressor::GIFLZWDecompressor function in filter.vcl/lgif/decode.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service…
CVE-2015-5213, published 2015-11-10. Medium severity, CVSS 6.8. EPSS: 12.9% chance of exploitation in the next 30 days. Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute…
CVE-2009-3301, published 2010-02-16. High severity, CVSS 9.3. EPSS: 12% chance of exploitation in the next 30 days. Integer underflow in filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a…
CVE-2007-2834, published 2007-09-18. High severity, CVSS 9.3. EPSS: 12% chance of exploitation in the next 30 days. Integer overflow in the TIFF parser in OpenOffice.org (OOo) before 2.3; and Sun StarOffice 6, 7, and 8 Office Suite (StarSuite); allows remote attackers to execute arbitrary code via a TIFF file with…

Latest

CVE-2025-64407, published 2025-11-12. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without…
CVE-2025-64406, published 2025-11-12. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other memory areas. This issue affects Apache…
CVE-2025-64405, published 2025-11-12. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without…
CVE-2025-64404, published 2025-11-12. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be…
CVE-2025-64403, published 2025-11-12. High severity, CVSS 8.1. EPSS: 1.3% chance of exploitation in the next 30 days. Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a…
CVE-2025-64402, published 2025-11-12. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without…
CVE-2025-64401, published 2025-11-12. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without…
CVE-2023-47804, published 2023-12-29. High severity, CVSS 8.8. EPSS: 2.7% chance of exploitation in the next 30 days. Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic…
CVE-2022-47502, published 2023-03-24. High severity, CVSS 7.8. EPSS: 1% chance of exploitation in the next 30 days. Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic…
CVE-2022-38745, published 2023-03-24. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.