CVE-2025-0514 Overview
CVE-2025-0514 is an improper input validation vulnerability in LibreOffice from The Document Foundation. The flaw allows Windows executable hyperlink targets embedded in documents to be executed unconditionally when a user activates the link. Affected versions include LibreOffice 24.8 prior to 24.8.5. The issue is tracked under CWE-20: Improper Input Validation and requires local user interaction on Windows hosts. An attacker who delivers a crafted document can trigger execution of an arbitrary executable without the warning prompt typically shown for risky hyperlink targets.
Critical Impact
A user clicking a hyperlink in a malicious LibreOffice document can execute an attacker-supplied Windows binary without the standard security prompt, enabling code execution on the host.
Affected Products
- LibreOffice 24.8 through versions earlier than 24.8.5
- The Document Foundation LibreOffice on Windows platforms
- LibreOffice document handlers processing hyperlinks pointing to executable targets
Discovery Timeline
- 2025-02-25 - CVE-2025-0514 published to NVD
- 2025-12-10 - Last updated in NVD database
Technical Details for CVE-2025-0514
Vulnerability Analysis
The vulnerability resides in how LibreOffice validates hyperlink targets when a user activates a link in a document. LibreOffice typically warns users before launching executable content referenced by a hyperlink. On affected versions, that validation is bypassed for Windows executable targets. Activating a crafted hyperlink causes the referenced binary to run unconditionally. The flaw shifts the security boundary from a user-confirmed action to a single-click execution, lowering the bar for document-based code execution attacks.
Root Cause
The root cause is improper input validation of the hyperlink target type. The hyperlink handler fails to gate Windows executable file types behind the standard confirmation logic that normally protects users from clicking through to dangerous content. Because the check is missing for this target class, the application proceeds to invoke the binary through the OS as if it were a benign navigation target.
Attack Vector
Exploitation requires local interaction. An attacker delivers a LibreOffice document containing a hyperlink that points to a Windows executable. The executable may reside on a network share, a removable device, or a path under attacker control on the local system. When the victim opens the document and clicks the hyperlink, LibreOffice launches the executable without prompting. The technique is well-suited to phishing campaigns that pair social engineering pretexts with weaponized .odt, .ods, or .odp files. No vendor-confirmed proof of concept or in-the-wild exploitation has been reported, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified public exploit code is available. Refer to the LibreOffice Security Advisory for vendor technical details.
Detection Methods for CVE-2025-0514
Indicators of Compromise
- LibreOffice processes (soffice.exe, soffice.bin) spawning child processes that are Windows executables originating from temporary, download, or network share paths
- Documents (.odt, .ods, .odp, .docx) containing hyperlink relationships referencing .exe, .bat, .cmd, .scr, or .com targets
- Outbound SMB or HTTP retrievals immediately preceding execution of an unsigned binary launched by a LibreOffice process
Detection Strategies
- Hunt for parent-child process relationships where soffice.bin launches binaries outside the LibreOffice installation directory
- Inspect LibreOffice documents during email and web gateway scanning for embedded hyperlinks targeting executable file extensions or UNC paths
- Correlate user-initiated document opens with subsequent process creation events to surface single-click execution chains
Monitoring Recommendations
- Enable Windows process creation auditing (Event ID 4688) and Sysmon Event ID 1 with command-line logging on endpoints running LibreOffice
- Track file writes by LibreOffice to user-writable directories followed by execution of those files
- Forward endpoint telemetry to a centralized SIEM and alert on LibreOffice spawning interpreters such as cmd.exe, powershell.exe, or wscript.exe
How to Mitigate CVE-2025-0514
Immediate Actions Required
- Upgrade LibreOffice to version 24.8.5 or later on all Windows endpoints
- Inventory installed LibreOffice versions across the estate and prioritize remediation on user workstations that process untrusted documents
- Advise users to avoid clicking hyperlinks in documents from untrusted or unverified senders until patching is complete
Patch Information
The Document Foundation has released LibreOffice 24.8.5, which corrects the hyperlink target validation logic. Patch details and download links are published in the LibreOffice Security Advisory for CVE-2025-0514. Apply the update through the official LibreOffice installer or your managed software distribution platform.
Workarounds
- Disable hyperlink activation in LibreOffice by holding the configured modifier key requirement and training users to inspect link targets before clicking
- Apply Windows AppLocker or Windows Defender Application Control policies that block execution of binaries from user-writable paths and network shares
- Restrict outbound SMB to prevent retrieval of executables referenced by UNC hyperlinks
- Use email gateway rules to strip or quarantine office documents containing hyperlinks pointing to executable extensions
# Verify installed LibreOffice version on Windows
"C:\Program Files\LibreOffice\program\soffice.exe" --version
# Example AppLocker rule fragment to deny executable launches from user temp paths
# (apply via Group Policy: Computer Configuration > Windows Settings > Security Settings > Application Control Policies)
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny -Path "%OSDRIVE%\Users\*\AppData\Local\Temp\*.exe"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
