CVE-2025-2866: LibreOffice PDF Signature Spoofing Flaw

CVE-2025-2866 Overview

CVE-2025-2866 is an Improper Verification of Cryptographic Signature vulnerability (CWE-347) in LibreOffice that allows PDF Signature Spoofing through improper validation. In the affected versions of LibreOffice, a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid, potentially allowing attackers to create fraudulent documents that appear legitimately signed.

Critical Impact

Attackers can craft malicious PDF documents with forged digital signatures that LibreOffice incorrectly validates as authentic, undermining document integrity and trust in signed PDF workflows.

Affected Products

• LibreOffice versions 24.8 before 24.8.6
• LibreOffice versions 25.2 before 25.2.2
• LibreOffice 24.8.0.0 alpha1 and beta1 releases
• LibreOffice 25.2.0.0 alpha1 and beta1 releases

Discovery Timeline

• 2025-04-27 - CVE-2025-2866 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-2866

Vulnerability Analysis

The vulnerability resides in LibreOffice's PDF signature verification implementation, specifically in how the application processes adbe.pkcs7.sha1 signatures. This signature format is a legacy PDF signature type that embeds a PKCS#7 signed data object containing a SHA-1 hash of the document's content.

The flaw allows crafted PDF documents with invalid cryptographic signatures to bypass validation checks and appear as legitimately signed. This represents a fundamental break in the trust model for digitally signed documents, as users rely on signature verification to confirm document authenticity and integrity.

The attack requires local access and user interaction, as the victim must open a malicious PDF document in a vulnerable version of LibreOffice. While the local attack vector and user interaction requirements limit the attack surface, the impact on document trust is significant for organizations relying on PDF signatures for legal or business purposes.

Root Cause

The root cause is improper verification logic in LibreOffice's cryptographic signature validation code for the adbe.pkcs7.sha1 signature format. The verification code fails to properly validate certain aspects of the signature structure, allowing malformed or invalid signatures to pass validation checks that should reject them.

This type of vulnerability typically occurs when signature verification implementations do not strictly enforce all required validation steps, such as proper certificate chain validation, hash comparison, or signature format conformance checks.

Attack Vector

The attack leverages the local file system attack vector, requiring an attacker to deliver a specially crafted PDF document to a victim. The attack scenario typically involves:

1. An attacker creates a PDF document with malicious content or falsified information
2. The attacker crafts an invalid adbe.pkcs7.sha1 signature that exploits the verification flaw
3. The malicious PDF is delivered to the victim via email, file sharing, or other means
4. When opened in a vulnerable LibreOffice version, the invalid signature is incorrectly displayed as valid
5. The victim trusts the document based on the apparent valid signature

The vulnerability enables signature spoofing attacks where documents can be made to appear signed by trusted entities without possessing the corresponding private keys. This could facilitate fraud, impersonation, or distribution of malicious content disguised as legitimate signed documents.

Detection Methods for CVE-2025-2866

Indicators of Compromise

• PDF documents with adbe.pkcs7.sha1 signatures that validate in LibreOffice but fail validation in other PDF readers
• Documents claiming to be signed by high-value targets (executives, legal entities) received from unexpected sources
• Unusual PDF file structures or signature objects that deviate from standard PKCS#7 formatting

Detection Strategies

• Cross-validate PDF signatures using multiple tools (Adobe Acrobat, PDF.js, online validators) when document authenticity is critical
• Implement file inspection policies that flag adbe.pkcs7.sha1 signed documents for additional scrutiny
• Monitor for LibreOffice version information in enterprise environments to identify vulnerable installations

Monitoring Recommendations

• Track LibreOffice installations across the organization and prioritize patching vulnerable versions
• Establish baseline signature verification procedures that do not rely solely on LibreOffice for critical document validation
• Review and audit any business processes that depend on LibreOffice PDF signature verification for trust decisions

How to Mitigate CVE-2025-2866

Immediate Actions Required

• Upgrade LibreOffice to version 24.8.6 or later for the 24.8 branch
• Upgrade LibreOffice to version 25.2.2 or later for the 25.2 branch
• Implement compensating controls by validating critical PDF signatures using alternative tools until patches are applied
• Alert users about the risk of trusting PDF signatures in vulnerable LibreOffice versions

Patch Information

LibreOffice has released security patches addressing this vulnerability. Users should upgrade to LibreOffice 24.8.6 or LibreOffice 25.2.2 or later versions to receive the fix. For detailed patch information and download links, refer to the LibreOffice Security Advisory CVE-2025-2866.

Debian LTS users should also monitor the Debian LTS Announcement for distribution-specific patches.

Workarounds

• Use alternative PDF readers (Adobe Acrobat, Foxit) for signature validation until LibreOffice is patched
• Implement organizational policies requiring dual-tool signature verification for legally binding documents
• Consider disabling or not relying on PDF signature verification in LibreOffice for critical business processes
• Train users to verify document authenticity through out-of-band communication when signatures are critical

# Check LibreOffice version on Linux systems
libreoffice --version

# Verify version is patched (should show 24.8.6+ or 25.2.2+)
# If vulnerable, download latest version from libreoffice.org