CVE-2024-3044 Overview
CVE-2024-3044 affects LibreOffice and allows an attacker to craft a document that silently executes built-in LibreOffice scripts when a user clicks an embedded graphic. The flaw stems from an unchecked script execution path in the Graphic on-click binding. Scripts previously classified as trusted are now considered untrusted, and the affected versions did not prompt the user before invoking them. The vulnerability is tracked under [CWE-356] Product UI Misrepresentation of Critical Information and [CWE-94] Improper Control of Generation of Code.
Critical Impact
A malicious document can execute internal LibreOffice scripts without user prompting when a graphic is clicked, enabling integrity and availability impact on the host application.
Affected Products
- LibreOffice (versions prior to the fixed releases listed in the vendor advisory)
- Fedora 39
- Debian Linux 10.0
Discovery Timeline
- 2024-05-14 - CVE-2024-3044 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-3044
Vulnerability Analysis
LibreOffice supports binding scripts to events on document objects, including the on-click event of embedded graphics. The affected versions treated built-in LibreOffice scripts as trusted and executed them without the user confirmation dialog shown for untrusted macros. An attacker crafts a document that attaches an on-click binding to a graphic. When the recipient clicks the graphic, the bound script runs with the privileges of the LibreOffice process. The vendor has reclassified these internal scripts as untrusted so that the normal macro security prompt applies.
Root Cause
The root cause is improper trust classification in the Graphic on-click event handler. The handler bypassed the macro security prompt because it considered the invoked scripts intrinsically safe. This classification did not account for scripts that can trigger side effects affecting document integrity or application state.
Attack Vector
Exploitation requires an attacker to deliver a crafted document, typically via email, file share, or web download. The victim opens the document in a vulnerable LibreOffice version and clicks a graphic. No additional privileges or authentication are required on the target system. Delivery is network-based, and the user interaction is a single click on an attacker-chosen graphic element.
No verified public proof-of-concept code is available. Refer to the LibreOffice Security Advisory CVE-2024-3044 for authoritative technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2024-3044
Indicators of Compromise
- Office documents containing graphic objects with script bindings to built-in LibreOffice macros or Basic routines.
- Unexpected child processes or script activity spawned by soffice.bin shortly after document open and user interaction.
- Documents sourced from untrusted email, chat, or download origins that contain embedded scripting constructs.
Detection Strategies
- Inspect ODF and OOXML documents for script:event-listener entries referencing on-click handlers bound to graphic frames.
- Alert on LibreOffice process trees where soffice.bin initiates unusual file, registry, or network operations after document open.
- Correlate macro security policy events with document open events to identify silent script execution attempts.
Monitoring Recommendations
- Monitor endpoints for LibreOffice version inventory to identify hosts still running vulnerable releases.
- Capture process telemetry for LibreOffice to establish a baseline of normal post-click behavior and detect deviations.
- Review mail gateway logs for inbound ODF, ODT, and ODS attachments and quarantine samples for sandbox analysis.
How to Mitigate CVE-2024-3044
Immediate Actions Required
- Upgrade LibreOffice to the fixed release identified in the LibreOffice Security Advisory CVE-2024-3044.
- Apply distribution updates referenced in the Debian LTS Security Announcement and the Fedora Package Announcement.
- Set macro security to High or Very High in Tools > Options > LibreOffice > Security > Macro Security to force prompting on untrusted scripts.
Patch Information
LibreOffice has released fixed versions that reclassify the previously trusted built-in scripts as untrusted so that the standard macro security prompt is enforced before execution. Debian and Fedora have shipped updated packages for their supported releases. Administrators should consult the vendor advisory for exact fixed version numbers and apply vendor-supplied packages through standard update channels.
Workarounds
- Disable macro and script execution by default across managed endpoints until patches are deployed.
- Train users to avoid clicking embedded graphics in documents received from untrusted sources.
- Open suspicious documents in a sandboxed or isolated environment that blocks outbound script side effects.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
