Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause such links
to be loaded without prompt.
This issue affects Apache OpenOffice: through 4.1.15.
Users are recommended to upgrade to version 4.1.16, which fixes the issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/t7c6jhvdb00xtgd9vvn7h5sq9f4h5trt | Mailing List Vendor Advisory |
| https://www.openoffice.org/security/cves/CVE-2025-64403.html | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2025/11/11/6 | Mailing List Third Party Advisory |
Configurations
History
13 Nov 2025, 15:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache openoffice
Apache |
|
| CPE | cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:* | |
| References | () https://lists.apache.org/thread/t7c6jhvdb00xtgd9vvn7h5sq9f4h5trt - Mailing List, Vendor Advisory | |
| References | () https://www.openoffice.org/security/cves/CVE-2025-64403.html - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2025/11/11/6 - Mailing List, Third Party Advisory |
12 Nov 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
12 Nov 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-12 09:15
Updated : 2025-11-13 15:08
NVD link : CVE-2025-64403
Mitre link : CVE-2025-64403
CVE.ORG link : CVE-2025-64403
JSON object : View
Products Affected
apache
- openoffice
CWE
CWE-862
Missing Authorization