Read the docs
TI-2025-39829 Aliases CVE-2025-64405GHSA-h4jv-xw7f-wjrg

Apache OpenOffice: Remote documents loaded without prompt via DDE function

Priority MEDIUM 42CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to external files would load the contents of those files without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01446 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache OpenOfficeup to 4.1.15—No fix listedCNA
  • Apache OpenOffice VendorApache Affected up to 4.1.15 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*before 4.1.16VulnerableApache
  • cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:* Versions before 4.1.16 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64405
  2. 2026-10-03 Alias added: GHSA-h4jv-xw7f-wjrg

References

Advisory 3

  • TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
  • TI-2021-12639 Buffer overflow from a crafted DBF file CVSS 3.1HIGH 7.8
  • TI-2014-02850 Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and… CVSS 2.0HIGH 9.3
  • TI-2009-02810 Heap-based buffer overflow in the GIFLZWDecompressor::GIFLZWDecompressor function in… CVSS 2.0HIGH 9.3
  • TI-2009-02809 Integer overflow in the XPMReader::ReadXPM function in filter.vcl/ixpm/svt_xpmread.cxx in… CVSS 2.0HIGH 9.3
  • TI-2009-03144 filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to… CVSS 2.0HIGH 9.3
See all 71 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences