CVE-2025-1080: LibreOffice URI Scheme RCE Vulnerability

CVE-2025-1080 Overview

CVE-2025-1080 is an input validation vulnerability in LibreOffice affecting the vnd.libreoffice.command Office URI Scheme. The scheme was introduced to support browser integration with Microsoft SharePoint. A maliciously crafted link using this scheme can embed an inner URL that, when processed by LibreOffice, invokes internal macros with attacker-controlled arguments. Exploitation requires user interaction, typically clicking a link in a browser. The flaw affects LibreOffice versions from 24.8 before 24.8.5 and from 25.2 before 25.2.1. The vulnerability is tracked under [CWE-20] Improper Input Validation.

Critical Impact
Attackers can invoke LibreOffice internal macros with arbitrary arguments through a crafted browser link, leading to arbitrary command execution in the local user context.

Affected Products

LibreOffice 24.8 before 24.8.5
LibreOffice 25.2 before 25.2.1
Debian Linux 11.0 (LibreOffice packages)

Discovery Timeline

2025-03-04 - CVE-2025-1080 published to NVD
2025-12-10 - Last updated in NVD database

Technical Details for CVE-2025-1080

Vulnerability Analysis

LibreOffice registers Office URI Schemes such as ms-word, ms-excel, and ms-powerpoint so browsers can hand off SharePoint documents to the local office suite. LibreOffice added a proprietary vnd.libreoffice.command scheme to extend this integration. The handler parses an embedded inner URL passed within the outer scheme link. Improper validation of the embedded URL allows attackers to direct LibreOffice to invoke internal macro commands with attacker-supplied arguments. Because macros run in the user context, the attacker gains the ability to execute arbitrary application logic on the victim system.

Root Cause

The root cause is insufficient validation of the embedded URL and command parameters delivered through the vnd.libreoffice.command scheme handler. The handler does not restrict which internal macro entry points may be invoked or sanitize their arguments. This permits parameter injection into LibreOffice macro dispatch logic.

Attack Vector

The attack requires a victim to click a malicious link in a browser on a system where LibreOffice is installed and registered as the handler for the affected URI scheme. The browser hands the URL to LibreOffice, which parses the embedded inner URL and dispatches the requested macro with attacker-controlled arguments. The vulnerability is locally exploited but delivered through web content. See the LibreOffice Security Advisory CVE-2025-1080 for technical details.

Detection Methods for CVE-2025-1080

Indicators of Compromise

Browser history or proxy logs containing URLs that begin with vnd.libreoffice.command: and include embedded inner URLs.
Unexpected soffice or soffice.bin process launches initiated by a browser parent process.
LibreOffice macro execution events with arguments referencing untrusted network locations or shell commands.

Detection Strategies

Inspect endpoint process telemetry for browsers spawning LibreOffice binaries with command-line arguments containing the vnd.libreoffice.command scheme.
Hunt for outbound network requests by LibreOffice processes immediately following a browser-driven launch.
Review installed LibreOffice versions across the fleet and flag any host below 24.8.5 or 25.2.1.

Monitoring Recommendations

Enable command-line auditing on Windows and execve auditing on Linux to capture LibreOffice invocation arguments.
Forward browser and process telemetry to a centralized analytics platform for correlation across URI scheme handlers.
Alert on any LibreOffice child process that executes shell interpreters such as cmd.exe, powershell.exe, or /bin/sh.

How to Mitigate CVE-2025-1080

Immediate Actions Required

Upgrade LibreOffice to version 24.8.5 or 25.2.1, or later, on all endpoints.
Apply Debian LTS package updates referenced in the Debian LTS Announcement.
Communicate to users the risk of clicking unsolicited vnd.libreoffice.command links.

Patch Information

The LibreOffice project released fixes in version 24.8.5 and 25.2.1 that correct validation of embedded URLs within the vnd.libreoffice.command scheme handler. Debian published corresponding package updates through the LTS channel. Patch details are documented in the LibreOffice Security Advisory CVE-2025-1080.

Workarounds

Unregister the vnd.libreoffice.command URI scheme handler from the operating system until patching is complete.
Configure browsers to prompt before launching external protocol handlers for LibreOffice.
Restrict LibreOffice macro execution policy to disable unsigned macros for all users.

bash

# Verify installed LibreOffice version on Linux
soffice --version

# Upgrade on Debian-based systems
sudo apt-get update && sudo apt-get install --only-upgrade libreoffice