CVE-2024-12426

6.7 mediumEPSS 0.5%

Medium (6.7). EPSS 0.5% chance of exploitation in the next 30 days.

Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. This issue affects LibreOffice: from 24.8 before < 24.8.4.

Severity

CVSS 4.0

6.7 medium

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2025-01-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
libreoffice:libreoffice

References

https://www.libreoffice.org/about-us/security/advisories/cve-2024-12426
https://lists.debian.org/debian-lts-announce/2025/01/msg00013.html

Check your stack JSON