CVE-2025-1080

· HIGHAnalyzed

← All CVEs

CVSS v3.1

7.8

CVSS v4.0

7.2

EPSS

0.30%

Published

Mar 4, 2025

Modified

Dec 10, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-20

Affected Products (3)

libreoffice · libreoffice (up to 24.8.5.1)vulnerable

libreoffice · libreoffice (up to 25.2.1.1)vulnerable

debian · debian_linuxvulnerable

References (2)

https://www.libreoffice.org/about-us/security/advisories/cve-2025-1080

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2025/06/msg00002.html

Mailing ListThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs