CVE-2024-12425

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12425
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.libreoffice.org/about-us/security/advisories/cve-2024-12425 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2025/01/msg00013.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:24.8.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:24.8.0.0:beta1:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

08 Dec 2025, 18:38

Type Values Removed Values Added
References () https://www.libreoffice.org/about-us/security/advisories/cve-2024-12425 - () https://www.libreoffice.org/about-us/security/advisories/cve-2024-12425 - Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2025/01/msg00013.html - () https://lists.debian.org/debian-lts-announce/2025/01/msg00013.html - Mailing List, Third Party Advisory
CPE cpe:2.3:a:libreoffice:libreoffice:24.8.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:24.8.0.0:beta1:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.3
First Time Libreoffice libreoffice
Debian
Debian debian Linux
Libreoffice

03 Nov 2025, 21:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/01/msg00013.html -
Summary
  • (es) La vulnerabilidad de limitación incorrecta de una ruta de acceso a un directorio restringido ('Path Traversal') en The Document Foundation LibreOffice permite un Path Traversal absoluto. Un atacante puede escribir en ubicaciones arbitrarias, aunque tengan el sufijo ".ttf", proporcionando un archivo en un formato que admita archivos de fuentes incrustados. Este problema afecta a LibreOffice: desde la versión 24.8 hasta la versión &lt; 24.8.4.

07 Jan 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-07 12:15

Updated : 2025-12-08 18:38

NVD link : CVE-2024-12425

Mitre link : CVE-2024-12425

CVE.ORG link : CVE-2024-12425

JSON object : View

Products Affected

libreoffice

  • libreoffice

debian

  • debian_linux
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')