What’s Vulnerable › Vulnerabilities

CVE-2021-25631: denylist of executable filename extensions possible to bypass under windows

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-05-03 · updated 2026-06-17
• Weakness: CWE-184

Description

In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an executable type.

Affected products

• The Document Foundation LibreOffice: from 7.0.0 before 7.0.5; from 7.1.0 before 7.1.2 — fixed in 7.0.5, 7.1.2

How to fix

Upgrade to a fixed version: The Document Foundation LibreOffice 7.0.5, 7.1.2. Check the vendor advisory for mitigations.

References

• https://positive.security/blog/url-open-rce#open-libreoffice
• https://www.libreoffice.org/about-us/security/advisories/cve-2021-25631/
• https://positive.security/blog/url-open-rce#open-libreoffice
• https://www.libreoffice.org/about-us/security/advisories/cve-2021-25631/

Get alerted when CVE-2021-25631 or the next vulnerability affects your stack