Improper Neutralization of Argument Delimiters in a Command in LibreOffice - CVE-2025-1080

Vulnerability identifier: #VU105300

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2025-1080

CWE-ID: CWE-88

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
LibreOffice
Oracle Linux
Debian Linux
Anolis OS
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Ubuntu
libreoffice-langpack-af
libreoffice-langpack-dz
libreoffice-langpack-de
libreoffice-langpack-da
libreoffice-langpack-cy
libreoffice-langpack-cs
libreoffice-langpack-ca
libreoffice-langpack-br
libreoffice-langpack-bn
libreoffice-langpack-bg
libreoffice-langpack-as
libreoffice-langpack-ar
libreoffice-langpack-el
libreoffice-impress
libreoffice-help-zh-Hant
libreoffice-help-zh-Hans
libreoffice-help-uk
libreoffice-help-tr
libreoffice-help-ta
libreoffice-help-sv
libreoffice-help-sl
libreoffice-help-sk
libreoffice-help-si
libreoffice-help-ru
libreoffice-langpack-he
libreoffice-langpack-lv
libreoffice-langpack-lt
libreoffice-langpack-ko
libreoffice-langpack-kn
libreoffice-langpack-kk
libreoffice-langpack-ja
libreoffice-langpack-it
libreoffice-langpack-id
libreoffice-langpack-hu
libreoffice-langpack-hr
libreoffice-langpack-hi
libreoffice-help-ro
libreoffice-langpack-gu
libreoffice-langpack-gl
libreoffice-langpack-ga
libreoffice-langpack-fr
libreoffice-langpack-fi
libreoffice-langpack-fa
libreoffice-langpack-eu
libreoffice-langpack-et
libreoffice-langpack-es
libreoffice-langpack-en
libreoffice-graphicfilter
libreoffice-help-el
libreoffice-help-dz
libreoffice-help-de
libreoffice-help-da
libreoffice-help-cs
libreoffice-help-ca
libreoffice-help-bn
libreoffice-help-bg
libreoffice-help-ar
libreoffice-gtk3
libreoffice-gtk2
libreoffice-help-es
libreoffice-glade
libreoffice-gdb-debug-support
libreoffice-filters
libreoffice-emailmerge
libreoffice-draw
libreoffice-core
libreoffice
libreoffice-base
libreoffice-bsh
libreoffice-calc
libreoffice-help-id
libreoffice-help-pt-PT
libreoffice-help-pt-BR
libreoffice-help-pl
libreoffice-help-nn
libreoffice-help-nl
libreoffice-help-nb
libreoffice-help-lv
libreoffice-help-lt
libreoffice-help-ko
libreoffice-help-ja
libreoffice-help-it
libreoffice-langpack-mai
libreoffice-help-hu
libreoffice-help-hr
libreoffice-help-hi
libreoffice-help-he
libreoffice-help-gu
libreoffice-help-gl
libreoffice-help-fr
libreoffice-help-fi
libreoffice-help-eu
libreoffice-help-et
autocorr-da
autocorr-is
autocorr-hu
autocorr-hr
autocorr-ga
autocorr-fr
autocorr-fi
autocorr-fa
autocorr-es
autocorr-en
autocorr-de
autocorr-it
autocorr-cs
autocorr-ca
autocorr-bg
autocorr-af
libreofficekit-devel
libreofficekit
libreoffice-xsltfilter
libreoffice-x11
libreoffice-writer
libreoffice-ure
autocorr-sk
libreoffice-ure-common
libreoffice-opensymbol-fonts
libreoffice-officebean-common
libreoffice-data
autocorr-zh
autocorr-vi
autocorr-tr
autocorr-sv
autocorr-sr
autocorr-sl
libreoffice-wiki-publisher
autocorr-ru
autocorr-ro
autocorr-pt
autocorr-pl
autocorr-nl
autocorr-mn
autocorr-lt
autocorr-lb
autocorr-ko
autocorr-ja
libreoffice-langpack-pt-BR
libreoffice-langpack-ta
libreoffice-sdk-doc
libreoffice-langpack-st
libreoffice-langpack-ss
libreoffice-langpack-sr
libreoffice-langpack-sl
libreoffice-langpack-sk
libreoffice-langpack-si
libreoffice-langpack-ru
libreoffice-langpack-ro
libreoffice-langpack-pt-PT
libreoffice-langpack-sv
libreoffice-langpack-pl
libreoffice-langpack-pa
libreoffice-langpack-or
libreoffice-langpack-nso
libreoffice-langpack-nr
libreoffice-langpack-nn
libreoffice-langpack-nl
libreoffice-langpack-nb
libreoffice-langpack-mr
libreoffice-langpack-ml
libreoffice-nlpsolver
libreoffice-sdk
libreoffice-rhino
libreoffice-pyuno
libreoffice-postgresql
libreoffice-pdfimport
libreoffice-ogltrans
libreoffice-officebean
libreoffice-langpack-te
libreoffice-math
libreoffice-librelogo
libreoffice-langpack-zu
libreoffice-langpack-zh-Hant
libreoffice-langpack-zh-Hans
libreoffice-langpack-xh
libreoffice-langpack-ve
libreoffice-langpack-uk
libreoffice-langpack-ts
libreoffice-langpack-tr
libreoffice-langpack-tn
libreoffice-langpack-th
libreoffice (Red Hat package)
libreoffice (Ubuntu package)
libreoffice-help-en
autocorr-el
libreoffice (Debian package)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper parsing of Office URI Schemes that enable integration of LibreOffice with MS SharePoint server. A remote attacker can trick the victim into clicking on a specially crafted URL and call internal macros with arbitrary arguments.

Install updates from vendor's website.

• https://www.libreoffice.org/about-us/security/advisories/cve-2025-1080