LibreOffice vnd.libreoffice.command URI flaw before 24.8.5/25.2.1 macro exec
CVE-2025-1080 Published on March 4, 2025
Macro URL arbitrary script execution
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments.
This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.
Vulnerability Analysis
CVE-2025-1080 is exploitable with local system access. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Products Associated with CVE-2025-1080
Want to know whenever a new CVE is published for LibreOffice? stack.watch will email you.
Affected Versions
The Document Foundation LibreOffice:- Version 24.8 and below < 24.8.5 is affected.
- Version 25.2 and below < 25.2.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.