CVE-2025-64402

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used "OLE objects" linked to external files would load the contents of those files without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue.

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-25)

CWE

CWE-862

Published

2025-11-12

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• apache:openoffice

References

• https://lists.apache.org/thread/tssrl88tygjsgk6csllm6p2fb6tlv8d8
• https://www.openoffice.org/security/cves/CVE-2025-64402.html
• http://www.openwall.com/lists/oss-security/2025/11/11/5

Check your stackJSON