Critical Security Update for LibreOffice: DSA-5908-1
Summary
DSA-5908-1: libreoffice - security update. Affects libreoffice versions < 4:7.4.7-1+deb12u8. Fixed in 4:7.4.7-1+deb12u8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreOffice is a powerful open-source office suite that provides a range of applications for word processing, spreadsheets, presentations, and more. It is widely used across various platforms due to its rich features and compatibility with multiple document formats. However, like any software, it can be vulnerable to security issues, which may compromise user data and system integrity.
Vulnerability Detail
The vulnerability identified as CVE-2025-2866 in LibreOffice allows for potential exploitation that could lead to unauthorized access or manipulation of documents. This issue arises from insufficient validation of user input, which can be exploited by attackers to execute arbitrary code or cause denial of service. The ramifications of this vulnerability could be severe, affecting not only individual users but also organizations that rely on LibreOffice for critical operations.
How To Fix
Minimum fixed version
4:7.4.7-1+deb12u8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libreofficeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of LibreOffice for opening untrusted documents until the update is applied. Additionally, disabling macros and other potentially risky features can help mitigate the risk of exploitation.
Conclusion
The security vulnerability CVE-2025-2866 in LibreOffice poses significant risks to users. It is crucial to update to the latest patched version to safeguard against potential exploits. Users should also consider temporary workarounds until they can apply the update.
See every vulnerability recorded for libreoffice →
FAQ
CVE-2025-2866 is a security vulnerability in LibreOffice that could allow attackers to execute arbitrary code or cause denial of service.
You can check your version of LibreOffice by going to 'Help' > 'About LibreOffice'. Compare it with the patched version 4:7.4.7-1+deb12u8.
If you cannot update immediately, avoid opening untrusted documents and disable macros to reduce the risk of exploitation.
More information can be found in the Debian security advisory DSA-5908-1 and on the CVE database.
Vulert monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for libreoffice.
